From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id E6761106B for ; Mon, 23 Mar 2015 16:11:28 +0100 (CET) Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga101.jf.intel.com with ESMTP; 23 Mar 2015 08:10:23 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.11,452,1422950400"; d="scan'208";a="702841962" Received: from unknown (HELO Sent) ([10.217.248.233]) by orsmga002.jf.intel.com with SMTP; 23 Mar 2015 08:10:18 -0700 Received: by Sent (sSMTP sendmail emulation); Mon, 23 Mar 2015 16:10:19 +0100 From: Maciej Gajdzica To: dev@dpdk.org Date: Mon, 23 Mar 2015 16:10:18 +0100 Message-Id: <1427123418-16238-1-git-send-email-maciejx.t.gajdzica@intel.com> X-Mailer: git-send-email 1.9.1 Subject: [dpdk-dev] [PATCH] table: fix a crash during key8 and key32 overload X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2015 15:11:29 -0000 hash_key8_ext and hash_key32_ext tables allocate cache entries to support table overload cases. The crash can occur when cache entry is free after use. The problem is with computing the index of the free cache entry. The same case for key16 was fixed with earlier patch. Signed-off-by: Maciej Gajdzica --- lib/librte_table/rte_table_hash_key32.c | 5 ++--- lib/librte_table/rte_table_hash_key8.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/librte_table/rte_table_hash_key32.c b/lib/librte_table/rte_table_hash_key32.c index da0ce6a..6790594 100644 --- a/lib/librte_table/rte_table_hash_key32.c +++ b/lib/librte_table/rte_table_hash_key32.c @@ -540,9 +540,8 @@ rte_table_hash_entry_delete_key32_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_32)); - bucket_index = (bucket - - ((struct rte_bucket_4_32 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } diff --git a/lib/librte_table/rte_table_hash_key8.c b/lib/librte_table/rte_table_hash_key8.c index 443ca7d..6803eb2 100644 --- a/lib/librte_table/rte_table_hash_key8.c +++ b/lib/librte_table/rte_table_hash_key8.c @@ -528,9 +528,8 @@ rte_table_hash_entry_delete_key8_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_8)); - bucket_index = (bucket - - ((struct rte_bucket_4_8 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } -- 1.7.9.5