[dpdk-dev] [PATCH] mempool: fix corruption due to invalid handler

[dpdk-dev] [PATCH] mempool: fix corruption due to invalid handler

[Weiliang Luo]

When using rte_mempool_create(), the mempool handler is selected
depending on the flags given by the user:
  - multi-consumer / multi-producer
  - multi-consumer / single-producer
  - single-consumer / multi-producer
  - single-consumer / single-producer

The flags were not properly tested, resulting in the selection of sc/sp
handler if sc/mp or mc/sp was asked. This can lead to corruption or
crashes because the get/put operations are not atomic.

Fixes: 449c49b93a6b ("mempool: support handler operations")

Signed-off-by: Weiliang Luo <droidluo@gmail.com>
Acked-by: Olivier Matz <olivier.matz@6wind.com>
---
 lib/librte_mempool/rte_mempool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/librte_mempool/rte_mempool.c b/lib/librte_mempool/rte_mempool.c
index 2e28e2e..350d77a 100644
--- a/lib/librte_mempool/rte_mempool.c
+++ b/lib/librte_mempool/rte_mempool.c
@@ -879,7 +879,7 @@ rte_mempool_create(const char *name, unsigned n, unsigned elt_size,
 	 * Since we have 4 combinations of the SP/SC/MP/MC examine the flags to
 	 * set the correct index into the table of ops structs.
 	 */
-	if (flags & (MEMPOOL_F_SP_PUT | MEMPOOL_F_SC_GET))
+	if ((flags & MEMPOOL_F_SP_PUT) && (flags & MEMPOOL_F_SC_GET))
 		rte_mempool_set_ops_byname(mp, "ring_sp_sc", NULL);
 	else if (flags & MEMPOOL_F_SP_PUT)
 		rte_mempool_set_ops_byname(mp, "ring_sp_mc", NULL);
-- 
2.7.4 (Apple Git-66)

Re: [dpdk-dev] [PATCH] mempool: fix corruption due to invalid handler

[Thomas Monjalon]

CC stable@dpdk.org

2016-09-08 10:29, Weiliang Luo:
> When using rte_mempool_create(), the mempool handler is selected
> depending on the flags given by the user:
>   - multi-consumer / multi-producer
>   - multi-consumer / single-producer
>   - single-consumer / multi-producer
>   - single-consumer / single-producer
> 
> The flags were not properly tested, resulting in the selection of sc/sp
> handler if sc/mp or mc/sp was asked. This can lead to corruption or
> crashes because the get/put operations are not atomic.
> 
> Fixes: 449c49b93a6b ("mempool: support handler operations")
> 
> Signed-off-by: Weiliang Luo <droidluo@gmail.com>
> Acked-by: Olivier Matz <olivier.matz@6wind.com>

Applied, thanks