From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [dpdk-dev] [Bug 820] [asan] table: buffer overflow in table_autotest
Date: Sat, 02 Oct 2021 15:45:04 +0000 [thread overview]
Message-ID: <bug-820-3@http.bugs.dpdk.org/> (raw)
https://bugs.dpdk.org/show_bug.cgi?id=820
Bug ID: 820
Summary: [asan] table: buffer overflow in table_autotest
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: other
Assignee: dev@dpdk.org
Reporter: david.marchand@redhat.com
CC: cristian.dumitrescu@intel.com
Target Milestone: ---
This issue was caught by ASAN.
To reproduce, please look at the last patch of series 18997:
https://github.com/ovsrobot/dpdk/commit/series_18997
64/94 DPDK:fast-tests / table_autotest FAIL 1.02 s (exit status 1)
--- command ---
DPDK_TEST='table_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpdk-test
-l 0-1 --file-prefix=table_autotest
--- stdout ---
RTE>>table_autotest
Getting/Creating the mempool ...
************Pipeline tests************
Added default entry to table id 0 with action 0
Added default entry to table id 1 with action 0
Pipeline Consistency OK!
Got no objects from ring 0 - error code 0
Got no objects from ring 1 - error code 0
Added default entry to table id 0 with action 1
Added default entry to table id 1 with action 1
Pipeline Consistency OK!
Got 2 object(s) from ring 0!
Object: at [0x7f55b8c85a00], len=0
Object: at [0x7f55b8c86340], len=0
Got 2 object(s) from ring 1!
Object: at [0x7f55b8c84780], len=0
Object: at [0x7f55b8c850c0], len=0
Added default entry to table id 0 with action 1
Added default entry to table id 1 with action 1
Pipeline Consistency OK!
STUB Table Action Miss - setting mask to 0x1
STUB Table Action Miss - setting mask to 0x1
Got 1 object(s) from ring 0!
Object: at [0x7f55b8c86340], len=0
Got 1 object(s) from ring 1!
Object: at [0x7f55b8c850c0], len=0
Added default entry to table id 0 with action 1
Added default entry to table id 1 with action 1
Pipeline Consistency OK!
STUB Table Action Miss - setting mask to 0x2
STUB Table Action Miss - setting mask to 0x2
Got 1 object(s) from ring 0!
Object: at [0x7f55b8c84780], len=0
Got 1 object(s) from ring 1!
Object: at [0x7f55b8c86340], len=0
Added default entry to table id 0 with action 1
Added default entry to table id 1 with action 1
Pipeline Consistency OK!
STUB Table Action Miss - setting mask to 0x3
STUB Table Action Miss - setting mask to 0x3
Got 2 object(s) from ring 0!
Object: at [0x7f55b8c85a00], len=0
Object: at [0x7f55b8c850c0], len=0
Got 2 object(s) from ring 1!
Object: at [0x7f55b8c86340], len=0
Object: at [0x7f55b8c84780], len=0
Setting first table to output to next table
Added default entry to table id 0 with action 3
Setting secont table to output to port
Added default entry to table id 0 with action 1
Setting first table to output to next table
Added default entry to table id 2 with action 3
Setting secont table to output to port
Added default entry to table id 2 with action 1
Pipeline Consistency OK!
Got 2 object(s) from ring 0!
Object: at [0x7f55b8c850c0], len=0
Object: at [0x7f55b8c85a00], len=0
Got 2 object(s) from ring 1!
Object: at [0x7f55b8c84780], len=0
Object: at [0x7f55b8c86340], len=0
TEST - two tables, hitmask override to 0x01
Setting first table to output to next table
Added default entry to table id 0 with action 3
Setting secont table to output to port
Added default entry to table id 0 with action 1
Setting first table to output to next table
Added default entry to table id 2 with action 3
Setting secont table to output to port
Added default entry to table id 2 with action 1
Pipeline Consistency OK!
STUB Table Action Miss - setting mask to 0x1
STUB Table Action Miss - setting mask to 0x1
STUB Table Action Miss - setting mask to 0x1
STUB Table Action Miss - setting mask to 0x1
Got 1 object(s) from ring 0!
Object: at [0x7f55b8c85a00], len=0
Got 1 object(s) from ring 1!
Object: at [0x7f55b8c86340], len=0
--- stderr ---
EAL: Detected 2 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Detected shared linkage of DPDK
EAL: WARNING! Base virtual address hint (0x100005000 != 0x7f59cb695000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: Multi-process socket /var/run/dpdk/table_autotest/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available 1048576 kB hugepages reported
EAL: VFIO support initialized
EAL: WARNING! Base virtual address hint (0x10000b000 != 0x7f59ba293000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100011000 != 0x7f59ba232000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100a12000 != 0x7f55b8400000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100c17000 != 0x7f59ba09f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x101618000 != 0x7f51b8200000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10181d000 != 0x7f59ba03e000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10221e000 != 0x7f4db8000000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102423000 != 0x7f59b9e9f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102e24000 != 0x7f49b7e00000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
APP: HPET is not enabled, using TSC as default timer
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: setup_pipeline: **** Setting up Stub test
PIPELINE: test_pipeline_single_filter: **** Running Stub test
PIPELINE: rte_pipeline_flush: pipeline parameter NULL
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1
PIPELINE: rte_pipeline_check_params: Incorrect value for parameter params
PIPELINE: rte_pipeline_create: Pipeline params check failed (-22)
PIPELINE: rte_pipeline_check_params: Incorrect value for parameter name
PIPELINE: rte_pipeline_create: Pipeline params check failed (-22)
PIPELINE: rte_pipeline_check_params: Incorrect value for parameter socket_id
PIPELINE: rte_pipeline_create: Pipeline params check failed (-22)
PIPELINE: rte_pipeline_create: Pipeline memory allocation failed
PIPELINE: rte_pipeline_check: pipeline parameter NULL
PORT: rte_port_ring_reader_create_internal: Invalid Parameters
PORT: rte_port_ring_reader_free: port is NULL
PORT: rte_port_ring_writer_create_internal: Invalid Parameters
PORT: rte_port_ring_writer_free: Port is NULL
PORT: rte_port_ring_writer_create_internal: Invalid Parameters
PORT: rte_port_ring_writer_create_internal: Invalid Parameters
TABLE: rte_table_array_free: table parameter is NULL
TABLE: rte_table_array_entry_add: table parameter is NULL
TABLE: rte_table_array_entry_add: entry parameter is NULL
TABLE: rte_table_lpm_create: NULL input parameters
TABLE: rte_table_lpm_create: Table name is NULL
TABLE: rte_table_lpm_create: Invalid n_rules
TABLE: rte_table_lpm_create: Invalid entry_unique_size
TABLE: rte_table_lpm_create: Invalid entry_unique_size
TABLE: rte_table_lpm_free: table parameter is NULL
TABLE: rte_table_lpm_entry_add: table parameter is NULL
TABLE: rte_table_lpm_entry_add: ip_prefix parameter is NULL
TABLE: rte_table_lpm_entry_add: entry parameter is NULL
TABLE: rte_table_lpm_entry_add: invalid depth (0)
TABLE: rte_table_lpm_entry_add: invalid depth (33)
=================================================================
==25453==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7ffd7a7c0d01 at pc 0x0000004a5d5a bp 0x7ffd7a7c0570 sp 0x7ffd7a7bfd38
READ of size 8 at 0x7ffd7a7c0d01 thread T0
#0 0x4a5d59 in __asan_memcpy
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x4a5d59)
#1 0x7f59c62f18e9 in rte_table_lpm_entry_add
/home/runner/work/dpdk/dpdk/build/../lib/table/rte_table_lpm.c:226:3
#2 0x2d1e6b2 in test_table_lpm
/home/runner/work/dpdk/dpdk/build/../app/test/test_table_tables.c:390:11
#3 0x2b26a0f in test_table
/home/runner/work/dpdk/dpdk/build/../app/test/test_table.c:163:12
#4 0x4d6166 in cmd_autotest_parsed
/home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10
#5 0x7f59c7def6c5 in cmdline_parse
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3
#6 0x7f59c7de88d5 in cmdline_valid_buffer
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8
#7 0x7f59c7df9f07 in rdline_char_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5
#8 0x7f59c7de903f in cmdline_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9
#9 0x5ac68e in main
/home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8
#10 0x7f59c0446bf6 in __libc_start_main
/build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#11 0x42ea19 in _start
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42ea19)
Address 0x7ffd7a7c0d01 is located in stack of thread T0 at offset 1217 in frame
#0 0x2d1d5cf in test_table_lpm
/home/runner/work/dpdk/dpdk/build/../app/test/test_table_tables.c:287
This frame has 8 object(s):
[32, 40) 'result_mask' (line 289)
[64, 576) 'mbufs' (line 290)
[640, 1152) 'entries' (line 292)
[1216, 1217) 'entry1' (line 293) <== Memory access at offset 1217 overflows
this variable
[1232, 1240) 'entry_ptr' (line 294)
[1264, 1268) 'key_found' (line 295)
[1280, 1312) 'lpm_params' (line 299)
[1344, 1352) 'lpm_key' (line 355)
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x4a5d59) in
__asan_memcpy
Shadow bytes around the buggy address:
0x10002f4f0150: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00
0x10002f4f0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f0190: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2
=>0x10002f4f01a0:[01]f2 00 f2 f2 f2 04 f2 00 00 00 00 f2 f2 f2 f2
0x10002f4f01b0: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002f4f01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==25453==ABORTING
--
You are receiving this mail because:
You are the assignee for the bug.
reply other threads:[~2021-10-02 15:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-820-3@http.bugs.dpdk.org/ \
--to=bugzilla@dpdk.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.