From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [dpdk-dev] [Bug 819] [asan] lpm: buffer overflow in lpm6_autotest
Date: Sat, 02 Oct 2021 15:41:45 +0000 [thread overview]
Message-ID: <bug-819-3@http.bugs.dpdk.org/> (raw)
https://bugs.dpdk.org/show_bug.cgi?id=819
Bug ID: 819
Summary: [asan] lpm: buffer overflow in lpm6_autotest
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: other
Assignee: dev@dpdk.org
Reporter: david.marchand@redhat.com
Target Milestone: ---
This issue was caught by ASAN.
To reproduce, please look at the last patch of series 18997:
https://github.com/ovsrobot/dpdk/commit/series_18997
36/94 DPDK:fast-tests / lpm6_autotest FAIL 6.54 s (exit status 1)
--- command ---
DPDK_TEST='lpm6_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpdk-test
-l 0-1 --file-prefix=lpm6_autotest
--- stdout ---
RTE>>lpm6_autotest
--- stderr ---
EAL: Detected 2 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Detected shared linkage of DPDK
EAL: WARNING! Base virtual address hint (0x100005000 != 0x7f26bdb3b000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: Multi-process socket /var/run/dpdk/lpm6_autotest/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available 1048576 kB hugepages reported
EAL: VFIO support initialized
EAL: WARNING! Base virtual address hint (0x10000b000 != 0x7f26ac739000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100011000 != 0x7f26ac59f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100a12000 != 0x7f22aaa00000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100c17000 != 0x7f26ac53e000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x101618000 != 0x7f1eaa800000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10181d000 != 0x7f26ac39f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10221e000 != 0x7f1aaa600000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102423000 != 0x7f26ac33e000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102e24000 != 0x7f16aa400000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
APP: HPET is not enabled, using TSC as default timer
RING: Cannot reserve memory
HASH: memory allocation failed
LPM: LPM rules hash table allocation failed: File exists
(17)=================================================================
==25187==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7ffdded97cf0 at pc 0x7f26b76a2206 bp 0x7ffdded972b0 sp 0x7ffdded972a8
READ of size 4 at 0x7ffdded97cf0 thread T0
#0 0x7f26b76a2205 in __rte_jhash_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:129:9
#1 0x7f26b76a1690 in rte_jhash_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:238:2
#2 0x7f26b76a15be in rte_jhash
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:284:2
#3 0x7f26b767d042 in rule_hash
/home/runner/work/dpdk/dpdk/build/../lib/lpm/rte_lpm6.c:160:9
#4 0x7f26b9727627 in rte_hash_hash
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:538:9
#5 0x7f26b9736926 in rte_hash_lookup_data
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:1449:45
#6 0x7f26b76a6982 in rule_find_with_key
/home/runner/work/dpdk/dpdk/build/../lib/lpm/rte_lpm6.c:454:8
#7 0x7f26b769b4dd in rule_add
/home/runner/work/dpdk/dpdk/build/../lib/lpm/rte_lpm6.c:497:15
#8 0x7f26b767da05 in rte_lpm6_add
/home/runner/work/dpdk/dpdk/build/../lib/lpm/rte_lpm6.c:882:20
#9 0x16d1ef9 in test9
/home/runner/work/dpdk/dpdk/build/../app/test/test_lpm6.c:456:11
#10 0x16de5cc in test_lpm6
/home/runner/work/dpdk/dpdk/build/../app/test/test_lpm6.c:1784:12
#11 0x4d6166 in cmd_autotest_parsed
/home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10
#12 0x7f26ba2956c5 in cmdline_parse
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3
#13 0x7f26ba28e8d5 in cmdline_valid_buffer
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8
#14 0x7f26ba29ff07 in rdline_char_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5
#15 0x7f26ba28f03f in cmdline_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9
#16 0x5ac68e in main
/home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8
#17 0x7f26b28ecbf6 in __libc_start_main
/build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#18 0x42ea19 in _start
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42ea19)
Address 0x7ffdded97cf0 is located in stack of thread T0 at offset 48 in frame
#0 0x7f26b769b36f in rule_add
/home/runner/work/dpdk/dpdk/build/../lib/lpm/rte_lpm6.c:488
This frame has 2 object(s):
[32, 49) 'rule_key' (line 490) <== Memory access at offset 48 partially
overflows this variable
[96, 100) 'unused' (line 491)
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:129:9 in
__rte_jhash_2hashes
Shadow bytes around the buggy address:
0x10003bdaaf40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10003bdaaf50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10003bdaaf60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10003bdaaf70: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00
0x10003bdaaf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10003bdaaf90: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00[01]f2
0x10003bdaafa0: f2 f2 f2 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00
0x10003bdaafb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10003bdaafc0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
0x10003bdaafd0: 04 f2 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x10003bdaafe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==25187==ABORTING
--
You are receiving this mail because:
You are the assignee for the bug.
reply other threads:[~2021-10-02 15:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-819-3@http.bugs.dpdk.org/ \
--to=bugzilla@dpdk.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.