Hi Andrew,

You observation is right. I was running vpp_lite with a buffer size of 512.
As you mentioned, defining PING_MAXIMUM_DATA_SIZE conditionally should work.

I have opened a jira ticket for this: https://jira.fd.io/browse/VPP-621

Thanks,
-nagp

On Fri, Jan 27, 2017 at 7:23 PM, Andrew 👽 Yourtchenko <ayour...@gmail.com>
wrote:

> Hello,
>
> > On 27 Jan 2017, at 04:12, Nagaprabhanjan Bellaru <nagp.li...@gmail.com>
> wrote:
> >
> > Hi,
> >
> > I am not sure if the ping debug CLI is being actively used, but the
> function "init_icmp46_echo_request" goes ahead and writes 2000 bytes into
> the vlib_buffer corrupting the surrounding memory area. After 3-4 pings,
> vpp always crashes.
>
> Could you please tell a bit more about the setup (which hypervisor, which
> make platform - vpp/vpp_lite, which ping etc) ? I had fixed a bug with
> processing a vector of replies (change 4844) - might be worth verifying you
> do not see the symptoms of that.
>
> Now, some thoughts below, please feel free to correct me if you find an
> error in the below logic.
>
> My understanding is we would get the 2048 bytes of max data size in DPDK
> case when allocating the buffer. Minus 20 bytes for IPv4 header, minus 4
> bytes for common ICMP header, minus 4 bytes for echo ID/seq, minus 8 bytes
> for the timestamp. That should give 2012 bytes of free space for data in
> IPv4 case, so for the IPv4 ping it should not overrun.
>
> The problem is of course in IPv6 case we are a few bytes short, and
> likewise in the vpp_lite case the VLIB_BUFFER_DATA_SIZE is 512, and we
> will overrun that with the static value of 2000.
>
> So the definition for PING_MAXIMUM_DATA_SIZE would need to depend on that
> define with appropriate  subtractions... or, even better, I suppose, is to
> use VLIB_BUFFER_DEFAULT_FREE_LIST_BYTES since that looks to me is the
> define determining the max data size for a buffer.
>
> Maybe an even better option could be to just fill a vector and then use
> the vlib_buffer_add_data() with zero buffer index, and let it allocate and
> set up everything behind the scenes.
>
> What do you think ?
>
> >
> > Instead of copying sizeof(icmp_echo_request->data) which is 2000, it we
> copy just data_len to the buffer, it should be fine?
>
> That would make the problem conditional on the CLI input for data size, so
> I would not say it is a much better outcome...
>
> --a
>
>
> >
> > Thanks,
> > -nagp
> > _______________________________________________
> > vpp-dev mailing list
> > vpp-dev@lists.fd.io
> > https://lists.fd.io/mailman/listinfo/vpp-dev
>
_______________________________________________
vpp-dev mailing list
vpp-dev@lists.fd.io
https://lists.fd.io/mailman/listinfo/vpp-dev

Reply via email to