https://bugs.dpdk.org/show_bug.cgi?id=1123
Bug ID: 1123
Summary: [dpdk-22.11][ASan Test] the stack-buffer-overflow was
found when quit testpmd in Redhat9
Product: DPDK
Version: 22.11
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: testpmd
Assignee: dev@dpdk.org
Reporter: zhiminx.hu...@intel.com
Target Milestone: ---
Environment：
DPDK:DPDK22.11
HW:Intel(R) Xeon(R) Gold 6139 CPU @ 2.30GHz
OS:Red Hat Enterprise Linux release 9.0/5.14.0-70.13.1.el9_0.x86_64
gcc:gcc version 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
NIC:Intel Corporation Ethernet Controller E810-C for QSFP [8086:1592]
driver: ice
version: 1.10.1
firmware-version: 4.10 0x80014596 1.3295.0
TestStep:
1.
rm x86_64-native-linuxapp-gcc/ -rf
CC=gcc meson -Denable_kmods=True -Dlibdir=lib -Dbuildtype=debug
-Db_lundef=false -Db_sanitize=address --default-library=static
x86_64-native-linuxapp-gcc
ninja -C x86_64-native-linuxapp-gcc -j 70
2.
./usertools/dpdk-devbind.py -b vfio-pci 0000:0b:00.0
3.
./x86_64-native-linuxapp-gcc/app/dpdk-testpmd -c 0xf -n 4 -- -i
4.
quit
Actual Result(Show the output from the previous commands)
=================================================================
==3933==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7f75435fb480 at pc 0x7f7547b88117 bp 0x7f75435fb450 sp 0x7f75435fabf8
WRITE of size 24 at 0x7f75435fb480 thread T16777215
#0 0x7f7547b88116 in __interceptor_sigaltstack.part.0
(/lib64/libasan.so.6+0x54116)
#1 0x7f7547c069e7 in __sanitizer::UnsetAlternateSignalStack()
(/lib64/libasan.so.6+0xd29e7)
#2 0x7f7547bf678c in __asan::AsanThread::Destroy()
(/lib64/libasan.so.6+0xc278c)
#3 0x7f754748f820 in __GI___nptl_deallocate_tsd (/lib64/libc.so.6+0xa1820)
#4 0x7f7547492595 in start_thread (/lib64/libc.so.6+0xa4595)
#5 0x7f75474323ef in clone3 (/lib64/libc.so.6+0x443ef)Address
0x7f75435fb480 is located in stack of thread T2 at offset 576 in frame
#0 0x129e3ba in mp_handle ../lib/eal/common/eal_common_proc.c:390 This
frame has 2 object(s):
[32, 142) 'sa' (line 392)
[176, 540) 'msg' (line 391) <== Memory access at offset 576 overflows this
variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
Thread T2 created by T0 here:
#0 0x7f7547b8c7d5 in pthread_create (/lib64/libasan.so.6+0x587d5)
#1 0x128126e in rte_ctrl_thread_create
../lib/eal/common/eal_common_thread.c:288
#2 0x129f844 in rte_mp_channel_init ../lib/eal/common/eal_common_proc.c:638
#3 0x12b99e6 in rte_eal_init ../lib/eal/linux/eal.c:1051
#4 0x7abde1 in main ../app/test-pmd/testpmd.c:4284
#5 0x7f7547432e4f in __libc_start_call_main
(/lib64/libc.so.6+0x44e4f)SUMMARY: AddressSanitizer: stack-buffer-overflow
(/lib64/libasan.so.6+0x54116) in __interceptor_sigaltstack.part.0
Shadow bytes around the buggy address:
0x0fef286b7640: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
0x0fef286b7650: 00 00 00 00 00 00 00 00 00 06 f2 f2 f2 f2 00 00
0x0fef286b7660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b7670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b7680: 00 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3
=>0x0fef286b7690:[f3]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b76a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b76b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b76c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b76d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fef286b76e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3933==ABORTING
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 45 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 16
On-line CPU(s) list: 0-15
Vendor ID: GenuineIntel
BIOS Vendor ID: GenuineIntel
Model name: Intel(R) Xeon(R) Gold 6140M CPU @ 2.30GHz
BIOS Model name: Intel(R) Xeon(R) Gold 6140M CPU @ 2.30GHz
CPU family: 6
Model: 85
Thread(s) per core: 1
Core(s) per socket: 1
Socket(s): 16
Stepping: 4
BogoMIPS: 4589.21
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1g
b rdtscp lm constant_tsc arch_perfmon nopl xtopology
tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq ssse3
fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt
tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3
dnowprefetch cpuid_fault invpcid_single pti ssbd ibrs
ibpb stibp fsgsbase tsc_adjust bmi1 avx2 smep bmi2 invpcid avx51
2f avx512dq rdseed adx smap clflushopt clwb avx512cd
avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves arat pku ospke m
d_clear flush_l1d arch_capabilities
Virtualization features:
Hypervisor vendor: VMware
Virtualization type: full
Caches (sum of all):
L1d: 512 KiB (16 instances)
L1i: 512 KiB (16 instances)
L2: 16 MiB (16 instances)
L3: 396 MiB (16 instances)
NUMA:
NUMA node(s): 1
NUMA node0 CPU(s): 0-15
Vulnerabilities:
Itlb multihit: KVM: Mitigation: VMX unsupported
L1tf: Mitigation; PTE Inversion
Mds: Mitigation; Clear CPU buffers; SMT Host state unknown
Meltdown: Mitigation; PTI
Spec store bypass: Mitigation; Speculative Store Bypass disabled via
prctl
Spectre v1: Mitigation; usercopy/swapgs barriers and __user
pointer sanitization
Spectre v2: Mitigation; Retpolines, IBPB conditional, IBRS_FW,
STIBP disabled, RSB filling
Srbds: Not affected
Tsx async abort: Not affected
Expected Result
Explain what is the expected result in text or as an example output:
no ASan error
--
You are receiving this mail because:
You are the assignee for the bug.
