All the mail mirrored from lore.kernel.org
 help / color / mirror / Atom feed
From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [dpdk-dev] [Bug 737] dpdk test_mbuf has heap-buffer-overflow
Date: Wed, 16 Jun 2021 03:20:23 +0000	[thread overview]
Message-ID: <bug-737-3@http.bugs.dpdk.org/> (raw)

https://bugs.dpdk.org/show_bug.cgi?id=737

            Bug ID: 737
           Summary: dpdk test_mbuf has heap-buffer-overflow
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: other
          Assignee: dev@dpdk.org
          Reporter: zhihongx.peng@intel.com
  Target Milestone: ---

Created attachment 160
  --> https://bugs.dpdk.org/attachment.cgi?id=160&action=edit
asan patch

Environment
dpdk: 21.05
test patch: 0001-asan-and-asan-gcc-patch.patch
Test Setup:
1. git apply 0007-porting-AddressSanitizer-feature-to-DPDK.patch
2. git apply 0001-Solve-gcc-compile-dpdk-asan.patch
3. git apply 0001-Solve-known-bugs.patch
4. CC=gcc meson --werror -Denable_kmods=True -Dlibdir=lib -Dbuildtype=debug
-Db_lundef=false -Db_sanitize=address --default-library=static
x86_64-native-linuxapp-gc
5. ninja -C x86_64-native-linuxapp-gcc -j 110
6. ./x86_64-native-linuxapp-gcc/app/test/dpdk-test -l
1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71
-n 4 --file-prefix=dpdk_7594_20210615194546
7. RTE>>mbuf_autotest
8. expect result
no error
actual result
There are some errors here:

==32584==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x7f753fb11078 at pc 0x000000833ec8 bp 0x7ffdf55d4d50 sp 0x7ffdf55d4d40
READ of size 8 at 0x7f753fb11078 thread T0
#0 0x833ec7 in rte_mempool_virt2iova ../lib/mempool/rte_mempool.h:1689
#1 0x86cf19 in test_pktmbuf_ext_shinfo_init_helper ../app/test/test_mbuf.c:2366
#2 0x86f282 in test_mbuf ../app/test/test_mbuf.c:2866
#3 0x407a9d in cmd_autotest_parsed ../app/test/commands.c:71
#4 0x1cab035 in cmdline_parse ../lib/cmdline/cmdline_parse.c:290
#5 0x1ca6610 in cmdline_valid_buffer ../lib/cmdline/cmdline.c:26
#6 0x1cb21a8 in rdline_char_in ../lib/cmdline/cmdline_rdline.c:421
#7 0x1ca6e95 in cmdline_in ../lib/cmdline/cmdline.c:149
#8 0x1ca73b8 in cmdline_interact ../lib/cmdline/cmdline.c:223
#9 0x428486 in main ../app/test/test.c:234
#10 0x7f7d4234b492 in __libc_start_main (/lib64/libc.so.6+0x23492)
#11 0x4077dd in _start
(/root/dpdk/x86_64-native-linuxapp-gcc/app/test/dpdk-test+0x4077dd)

Address 0x7f753fb11078 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow
../lib/mempool/rte_mempool.h:1689 in rte_mempool_virt2iova
Shadow bytes around the buggy address:
0x0fef27f5a1b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0fef27f5a1c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0fef27f5a1d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0fef27f5a1e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0fef27f5a1f0: fd fd fd fd fd fd fd fd 00 00 00 00 00 00 00 00
=>0x0fef27f5a200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa[fa]
0x0fef27f5a210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef27f5a220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef27f5a230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef27f5a240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef27f5a250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

-- 
You are receiving this mail because:
You are the assignee for the bug.

                 reply	other threads:[~2021-06-16  3:20 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-737-3@http.bugs.dpdk.org/ \
    --to=bugzilla@dpdk.org \
    --cc=dev@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.