From: Zhirun Yan <zhirun.yan@intel.com>
To: dev@dpdk.org, jerinj@marvell.com, kirankumark@marvell.com
Cc: Zhirun Yan <zhirun.yan@intel.com>,
Liang@dpdk.org, Cunming <cunming.liang@intel.com>
Subject: [PATCH v1] graph: fix out of bounds access when re-allocate node objs
Date: Wed, 27 Jul 2022 10:39:24 +0800 [thread overview]
Message-ID: <20220727023924.2066465-1-zhirun.yan@intel.com> (raw)
For __rte_node_enqueue_prologue(), If the number of objs is more than
the node->size * 2, the extra objs will write out of bounds memory.
It should use __rte_node_stream_alloc_size() to request enough memory.
And for rte_node_next_stream_put(), it will re-allocate a small size,
when the node free space is small and new objs is less than the current
node->size. Some objs pointers behind new size may be lost. And it will
cause memory leak. It should request enough size of memory, containing
the original objs and new objs at least.
Fixes: 40d4f51403ec ("graph: implement fastpath routines")
Signed-off-by: Zhirun Yan <zhirun.yan@intel.com>
Signed-off-by: Liang, Cunming <cunming.liang@intel.com>
---
lib/graph/rte_graph_worker.h | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/lib/graph/rte_graph_worker.h b/lib/graph/rte_graph_worker.h
index 0c0b9c095a..b7d145c3cb 100644
--- a/lib/graph/rte_graph_worker.h
+++ b/lib/graph/rte_graph_worker.h
@@ -218,13 +218,16 @@ static __rte_always_inline void
__rte_node_enqueue_prologue(struct rte_graph *graph, struct rte_node *node,
const uint16_t idx, const uint16_t space)
{
+ uint32_t req_size;
/* Add to the pending stream list if the node is new */
if (idx == 0)
__rte_node_enqueue_tail_update(graph, node);
- if (unlikely(node->size < (idx + space)))
- __rte_node_stream_alloc(graph, node);
+ if (unlikely(node->size < (idx + space))) {
+ req_size = rte_align32pow2(node->size + space);
+ __rte_node_stream_alloc_size(graph, node, req_size);
+ }
}
/**
@@ -430,9 +433,12 @@ rte_node_next_stream_get(struct rte_graph *graph, struct rte_node *node,
node = __rte_node_next_node_get(node, next);
const uint16_t idx = node->idx;
uint16_t free_space = node->size - idx;
+ uint32_t req_size;
- if (unlikely(free_space < nb_objs))
- __rte_node_stream_alloc_size(graph, node, nb_objs);
+ if (unlikely(free_space < nb_objs)) {
+ req_size = rte_align32pow2(node->size + nb_objs);
+ __rte_node_stream_alloc_size(graph, node, req_size);
+ }
return &node->objs[idx];
}
--
2.25.1
next reply other threads:[~2022-07-27 2:39 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-27 2:39 Zhirun Yan [this message]
2022-08-01 13:13 ` Jerin Jacob
2022-08-04 6:02 ` [PATCH v2] " Zhirun Yan
2022-09-20 8:05 ` [EXT] " Jerin Jacob Kollanukkaran
2022-10-10 15:31 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220727023924.2066465-1-zhirun.yan@intel.com \
--to=zhirun.yan@intel.com \
--cc=Liang@dpdk.org \
--cc=cunming.liang@intel.com \
--cc=dev@dpdk.org \
--cc=jerinj@marvell.com \
--cc=kirankumark@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).