[PATCH] trace: fix out of bounds write in __rte_trace_mem_get

[PATCH] trace: fix out of bounds write in __rte_trace_mem_get

[Oleksandr Nahnybida]

Offset should be aligned first before checking if there is free space for
another write.

Bugzilla ID: 1665
Fixes: ebaee6409702 ("trace: simplify trace point headers")

Signed-off-by: Oleksandr Nahnybida <oleksandrn@interfacemasters.com>
---
 lib/eal/include/rte_trace_point.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lib/eal/include/rte_trace_point.h b/lib/eal/include/rte_trace_point.h
index 8a317d31d2..343e0271b3 100644
--- a/lib/eal/include/rte_trace_point.h
+++ b/lib/eal/include/rte_trace_point.h
@@ -328,7 +328,7 @@ __rte_trace_mem_get(uint64_t in)
 			return NULL;
 	}
 	/* Check the wrap around case */
-	uint32_t offset = trace->offset;
+	uint32_t offset = RTE_ALIGN_CEIL(trace->offset, __RTE_TRACE_EVENT_HEADER_SZ);
 	if (unlikely((offset + sz) >= trace->len)) {
 		/* Disable the trace event if it in DISCARD mode */
 		if (unlikely(in & __RTE_TRACE_FIELD_ENABLE_DISCARD))
@@ -336,8 +336,6 @@ __rte_trace_mem_get(uint64_t in)
 
 		offset = 0;
 	}
-	/* Align to event header size */
-	offset = RTE_ALIGN_CEIL(offset, __RTE_TRACE_EVENT_HEADER_SZ);
 	void *mem = RTE_PTR_ADD(&trace->mem[0], offset);
 	offset += sz;
 	trace->offset = offset;
-- 
2.49.0

RE: [EXTERNAL] [PATCH] trace: fix out of bounds write in __rte_trace_mem_get

[Sunil Kumar Kori]

> Offset should be aligned first before checking if there is free space for another
> write.
> 
> Bugzilla ID: 1665
> Fixes: ebaee6409702 ("trace: simplify trace point headers")
> 
> Signed-off-by: Oleksandr Nahnybida <oleksandrn@interfacemasters.com>
> ---
>  lib/eal/include/rte_trace_point.h | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> --
> 2.49.0
Acked-by: Sunil Kumar Kori <skori@marvell.com>

Re: [PATCH] trace: fix out of bounds write in __rte_trace_mem_get

[David Marchand]

On Wed, Apr 2, 2025 at 11:35 AM Oleksandr Nahnybida
<oleksandrn@interfacemasters.com> wrote:
>
> Offset should be aligned first before checking if there is free space for
> another write.
>
> Bugzilla ID: 1665
> Fixes: ebaee6409702 ("trace: simplify trace point headers")

This commit ebaee6409702 ("trace: simplify trace point headers") just
moved code around.

I think the bug was present since the first implementation, so:
Fixes: 032a7e5499a0 ("trace: implement provider payload")


-- 
David Marchand