From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by dpdk.org (Postfix) with ESMTP id 22875AF85 for ; Wed, 8 Jun 2016 16:34:08 +0200 (CEST) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga104.fm.intel.com with ESMTP; 08 Jun 2016 07:33:56 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.26,439,1459839600"; d="scan'208";a="971502496" Received: from smonroyx-mobl.ger.corp.intel.com (HELO [10.237.220.56]) ([10.237.220.56]) by orsmga001.jf.intel.com with ESMTP; 08 Jun 2016 07:33:57 -0700 To: Slawomir Mrozowicz , david.marchand@6wind.com References: <1461756562-5824-1-git-send-email-slawomirx.mrozowicz@intel.com> Cc: dev@dpdk.org From: Sergio Gonzalez Monroy Message-ID: Date: Wed, 8 Jun 2016 15:33:54 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <1461756562-5824-1-git-send-email-slawomirx.mrozowicz@intel.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [dpdk-dev] [PATCH v2] eal: out-of-bounds write X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jun 2016 14:34:09 -0000 I missed this patch at the time! On 27/04/2016 12:29, Slawomir Mrozowicz wrote: > Fix issue reported by Coverity. > > Coverity ID 13282: Out-of-bounds write > overrun-local: Overrunning array mcfg->memseg of 256 44-byte elements > at element index 257 using index j. > > Fixes: af75078fece3 ("first public release") > > Signed-off-by: Slawomir Mrozowicz > --- > lib/librte_eal/linuxapp/eal/eal_memory.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c > index 5b9132c..715bd52 100644 > --- a/lib/librte_eal/linuxapp/eal/eal_memory.c > +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c > @@ -1333,8 +1333,11 @@ rte_eal_hugepage_init(void) > > if (new_memseg) { > j += 1; > - if (j == RTE_MAX_MEMSEG) > + if (j >= RTE_MAX_MEMSEG) { > + RTE_LOG(ERR, EAL, > + "Failed: memseg reached RTE_MAX_MEMSEG\n"); > break; > + } > > mcfg->memseg[j].phys_addr = hugepage[i].physaddr; > mcfg->memseg[j].addr = hugepage[i].final_va; As Bruce was suggesting in his comment to the v1, it's more helpful to do a check before the loop and print a message distinguishing the error case, something along the lines of: "all memsegs used by ivshmem. Please either increase....", returning with -ENOMEM error. Sergio