From: Jerin Jacob <jerinjacobk@gmail.com>
To: Zhirun Yan <zhirun.yan@intel.com>
Cc: dpdk-dev <dev@dpdk.org>, Jerin Jacob <jerinj@marvell.com>,
Kiran Kumar K <kirankumark@marvell.com>,
Liang@dpdk.org, Cunming <cunming.liang@intel.com>
Subject: Re: [PATCH v1] graph: fix out of bounds access when re-allocate node objs
Date: Mon, 1 Aug 2022 18:43:32 +0530 [thread overview]
Message-ID: <CALBAE1P0be08Rtnk21qfq7+YLhnVTmtz5rFj_vxAQSmpkdNqQA@mail.gmail.com> (raw)
In-Reply-To: <20220727023924.2066465-1-zhirun.yan@intel.com>
On Wed, Jul 27, 2022 at 8:10 AM Zhirun Yan <zhirun.yan@intel.com> wrote:
>
> For __rte_node_enqueue_prologue(), If the number of objs is more than
> the node->size * 2, the extra objs will write out of bounds memory.
> It should use __rte_node_stream_alloc_size() to request enough memory.
>
> And for rte_node_next_stream_put(), it will re-allocate a small size,
> when the node free space is small and new objs is less than the current
> node->size. Some objs pointers behind new size may be lost. And it will
> cause memory leak. It should request enough size of memory, containing
> the original objs and new objs at least.
>
> Fixes: 40d4f51403ec ("graph: implement fastpath routines")
>
> Signed-off-by: Zhirun Yan <zhirun.yan@intel.com>
> Signed-off-by: Liang, Cunming <cunming.liang@intel.com>
> ---
> lib/graph/rte_graph_worker.h | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/lib/graph/rte_graph_worker.h b/lib/graph/rte_graph_worker.h
> index 0c0b9c095a..b7d145c3cb 100644
> --- a/lib/graph/rte_graph_worker.h
> +++ b/lib/graph/rte_graph_worker.h
> @@ -218,13 +218,16 @@ static __rte_always_inline void
> __rte_node_enqueue_prologue(struct rte_graph *graph, struct rte_node *node,
> const uint16_t idx, const uint16_t space)
> {
> + uint32_t req_size;
>
> /* Add to the pending stream list if the node is new */
> if (idx == 0)
> __rte_node_enqueue_tail_update(graph, node);
>
> - if (unlikely(node->size < (idx + space)))
> - __rte_node_stream_alloc(graph, node);
> + if (unlikely(node->size < (idx + space))) {
> + req_size = rte_align32pow2(node->size + space);
> + __rte_node_stream_alloc_size(graph, node, req_size);
> + }
Change looks good to me.
Please have an inline function to avoid code duplication(Same change
in rte_node_next_stream_get())
With above change:
Acked-by: Jerin Jacob <jerinj@marvell.com>
> }
>
> /**
> @@ -430,9 +433,12 @@ rte_node_next_stream_get(struct rte_graph *graph, struct rte_node *node,
> node = __rte_node_next_node_get(node, next);
> const uint16_t idx = node->idx;
> uint16_t free_space = node->size - idx;
> + uint32_t req_size;
>
> - if (unlikely(free_space < nb_objs))
> - __rte_node_stream_alloc_size(graph, node, nb_objs);
> + if (unlikely(free_space < nb_objs)) {
> + req_size = rte_align32pow2(node->size + nb_objs);
> + __rte_node_stream_alloc_size(graph, node, req_size);
> + }
>
> return &node->objs[idx];
> }
> --
> 2.25.1
>
next prev parent reply other threads:[~2022-08-01 13:14 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-27 2:39 Zhirun Yan
2022-08-01 13:13 ` Jerin Jacob [this message]
2022-08-04 6:02 ` [PATCH v2] " Zhirun Yan
2022-09-20 8:05 ` [EXT] " Jerin Jacob Kollanukkaran
2022-10-10 15:31 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CALBAE1P0be08Rtnk21qfq7+YLhnVTmtz5rFj_vxAQSmpkdNqQA@mail.gmail.com \
--to=jerinjacobk@gmail.com \
--cc=Liang@dpdk.org \
--cc=cunming.liang@intel.com \
--cc=dev@dpdk.org \
--cc=jerinj@marvell.com \
--cc=kirankumark@marvell.com \
--cc=zhirun.yan@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).