From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 0BBCAA00C5; Thu, 4 Aug 2022 08:02:55 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 518914069C; Thu, 4 Aug 2022 08:02:55 +0200 (CEST) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by mails.dpdk.org (Postfix) with ESMTP id CC73D4068E for ; Thu, 4 Aug 2022 08:02:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1659592974; x=1691128974; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=SwCirshFY1M1gqTUs0idernZ8Wi87chOrckOdGaonc8=; b=HfVQtWm7tgRFMSGzscyKUH6s2KCnO8tA9XMic/2RxP3ddQENrgCCaxgB ei3Itvo0h0/1qeEJlKqJadUpAXzY/eEt2GL2miK1yC2T7Y9HFJYYetUh4 vG9+qzw14jvKB2+ylO27uSUXh+qjP25jLvV1clWXhHkiiJEt1lfpIvNSt 9rVKpwkLV3LxmCFJB5gbB10iS4D/FMuB3l2bea2JJHj8S9bUv9Ax0qjoJ Lgy8ijT6JHlmssXbRBTUQYZjq+hO4zjjpsBOzbiT30fbIN8F9xRKYsFW6 COK3DMtxThbgm3gfNCywS3wVVjh1+MylT94ZVH4kU6zOaG9eJFOpWrmcQ g==; X-IronPort-AV: E=McAfee;i="6400,9594,10428"; a="276765240" X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="276765240" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Aug 2022 23:02:52 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="553595786" Received: from dpdk-zhirun-lmm.sh.intel.com ([10.67.118.165]) by orsmga003.jf.intel.com with ESMTP; 03 Aug 2022 23:02:51 -0700 From: Zhirun Yan To: dev@dpdk.org, jerinj@marvell.com, kirankumark@marvell.com Cc: Zhirun Yan , Cunming Liang Subject: [PATCH v2] graph: fix out of bounds access when re-allocate node objs Date: Thu, 4 Aug 2022 14:02:41 +0800 Message-Id: <20220804060241.1581110-1-zhirun.yan@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220727023924.2066465-1-zhirun.yan@intel.com> References: <20220727023924.2066465-1-zhirun.yan@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org For __rte_node_enqueue_prologue(), If the number of objs is more than the node->size * 2, the extra objs will write out of bounds memory. It should use __rte_node_stream_alloc_size() to request enough memory. And for rte_node_next_stream_put(), it will re-allocate a small size, when the node free space is small and new objs is less than the current node->size. Some objs pointers behind new size may be lost. And it will cause memory leak. It should request enough size of memory, containing the original objs and new objs at least. Fixes: 40d4f51403ec ("graph: implement fastpath routines") Signed-off-by: Zhirun Yan Signed-off-by: Cunming Liang --- lib/graph/rte_graph_worker.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/graph/rte_graph_worker.h b/lib/graph/rte_graph_worker.h index 0c0b9c095a..6dc7461659 100644 --- a/lib/graph/rte_graph_worker.h +++ b/lib/graph/rte_graph_worker.h @@ -224,7 +224,7 @@ __rte_node_enqueue_prologue(struct rte_graph *graph, struct rte_node *node, __rte_node_enqueue_tail_update(graph, node); if (unlikely(node->size < (idx + space))) - __rte_node_stream_alloc(graph, node); + __rte_node_stream_alloc_size(graph, node, node->size + space); } /** @@ -432,7 +432,7 @@ rte_node_next_stream_get(struct rte_graph *graph, struct rte_node *node, uint16_t free_space = node->size - idx; if (unlikely(free_space < nb_objs)) - __rte_node_stream_alloc_size(graph, node, nb_objs); + __rte_node_stream_alloc_size(graph, node, node->size + nb_objs); return &node->objs[idx]; } -- 2.25.1