[dpdk-dev] [PATCH] lpm6: fix use after free of lpm in rte_lpm6_create

[dpdk-dev] [PATCH] lpm6: fix use after free of lpm in rte_lpm6_create

[Christian Ehrhardt]

In certain autotests lpm->max_rules turned out to be non initialized.
That was caused by a failing allocation for lpm->rules_tbl in rte_lpm6_create.
It then left the function via goto exit with lpm freed, but still a pointer
value being set.

In case of an allocation failure it resets lpm to NULL now, to avoid the
upper layers operate on that already freed memory.
Along that is also makes the RTE_LOG message of the failed allocation unique.
---
 lib/librte_lpm/rte_lpm6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/librte_lpm/rte_lpm6.c b/lib/librte_lpm/rte_lpm6.c
index 6c2b293..48931cc 100644
--- a/lib/librte_lpm/rte_lpm6.c
+++ b/lib/librte_lpm/rte_lpm6.c
@@ -206,8 +206,9 @@ rte_lpm6_create(const char *name, int socket_id,
 			(size_t)rules_size, RTE_CACHE_LINE_SIZE, socket_id);
 
 	if (lpm->rules_tbl == NULL) {
-		RTE_LOG(ERR, LPM, "LPM memory allocation failed\n");
+		RTE_LOG(ERR, LPM, "LPM rules_tbl allocation failed\n");
 		rte_free(lpm);
+		lpm = NULL;
 		rte_free(te);
 		goto exit;
 	}
-- 
2.7.0

Re: [dpdk-dev] [PATCH] lpm6: fix use after free of lpm in rte_lpm6_create

[Stephen Hemminger]

On Fri,  4 Mar 2016 11:31:20 +0100
Christian Ehrhardt <christian.ehrhardt@canonical.com> wrote:

> In certain autotests lpm->max_rules turned out to be non initialized.
> That was caused by a failing allocation for lpm->rules_tbl in rte_lpm6_create.
> It then left the function via goto exit with lpm freed, but still a pointer
> value being set.
> 
> In case of an allocation failure it resets lpm to NULL now, to avoid the
> upper layers operate on that already freed memory.
> Along that is also makes the RTE_LOG message of the failed allocation unique.
> ---
>  lib/librte_lpm/rte_lpm6.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/librte_lpm/rte_lpm6.c b/lib/librte_lpm/rte_lpm6.c
> index 6c2b293..48931cc 100644
> --- a/lib/librte_lpm/rte_lpm6.c
> +++ b/lib/librte_lpm/rte_lpm6.c
> @@ -206,8 +206,9 @@ rte_lpm6_create(const char *name, int socket_id,
>  			(size_t)rules_size, RTE_CACHE_LINE_SIZE, socket_id);
>  
>  	if (lpm->rules_tbl == NULL) {
> -		RTE_LOG(ERR, LPM, "LPM memory allocation failed\n");
> +		RTE_LOG(ERR, LPM, "LPM rules_tbl allocation failed\n");
>  		rte_free(lpm);
> +		lpm = NULL;
>  		rte_free(te);
>  		goto exit;
>  	}

Acked-by: Stephen Hemminger <stephen@networkplumber.org>

Re: [dpdk-dev] [PATCH] lpm6: fix use after free of lpm in rte_lpm6_create

[Christian Ehrhardt]

Hi,
thanks already Stephen for your ack on this patch.

I was realizing that my lpm patches were still not applied which is ok
given the amount of patches flowing by, but I wanted to ask again.
Considering the discussion between Bruce and Thomas about review and
maintainers I realized it might be best to add the respective maitainer as
a "to".
Sorry I had forgotten that the first time - In the lpm case that is Bruce,
so addressing directly.

It is about two patches, I didn't know about the second when submitting the
first so they are two individual submissions and not a series.
They still apply as of today (slight offset now but still applying).
Please let me know if you want them grouped to a series, rebased or
anything else before committing.

The two patches I talk about:
http://dpdk.org/dev/patchwork/patch/11067/
http://dpdk.org/dev/patchwork/patch/11065/

Thanks in advance,
Christian


Christian Ehrhardt
Software Engineer, Ubuntu Server
Canonical Ltd

On Fri, Mar 4, 2016 at 11:42 PM, Stephen Hemminger <
stephen@networkplumber.org> wrote:

> On Fri,  4 Mar 2016 11:31:20 +0100
> Christian Ehrhardt <christian.ehrhardt@canonical.com> wrote:
>
> > In certain autotests lpm->max_rules turned out to be non initialized.
> > That was caused by a failing allocation for lpm->rules_tbl in
> rte_lpm6_create.
> > It then left the function via goto exit with lpm freed, but still a
> pointer
> > value being set.
> >
> > In case of an allocation failure it resets lpm to NULL now, to avoid the
> > upper layers operate on that already freed memory.
> > Along that is also makes the RTE_LOG message of the failed allocation
> unique.
> > ---
> >  lib/librte_lpm/rte_lpm6.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/lib/librte_lpm/rte_lpm6.c b/lib/librte_lpm/rte_lpm6.c
> > index 6c2b293..48931cc 100644
> > --- a/lib/librte_lpm/rte_lpm6.c
> > +++ b/lib/librte_lpm/rte_lpm6.c
> > @@ -206,8 +206,9 @@ rte_lpm6_create(const char *name, int socket_id,
> >                       (size_t)rules_size, RTE_CACHE_LINE_SIZE,
> socket_id);
> >
> >       if (lpm->rules_tbl == NULL) {
> > -             RTE_LOG(ERR, LPM, "LPM memory allocation failed\n");
> > +             RTE_LOG(ERR, LPM, "LPM rules_tbl allocation failed\n");
> >               rte_free(lpm);
> > +             lpm = NULL;
> >               rte_free(te);
> >               goto exit;
> >       }
>
> Acked-by: Stephen Hemminger <stephen@networkplumber.org>
>