From: Miroslaw Walukiewicz Date: Tue, 3 Mar 2015 14:16:00 +0000 (-0500) Subject: table: fix crash during key overload X-Git-Tag: spdx-start~9377 X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=2f95a470b80df115a0a0c9fba4bfbae73f4d66ae;p=dpdk.git table: fix crash during key overload hash_key8_ext, hash_key16_ext and hash_key32_ext tables allocate cache entries to support table overload cases. The crash can occur when cache entry is free after use. The problem is with computing the index of the free cache entry. Signed-off-by: Mirek Walukiewicz Signed-off-by: Maciej Gajdzica Acked-by: Cristian Dumitrescu --- diff --git a/lib/librte_table/rte_table_hash_key16.c b/lib/librte_table/rte_table_hash_key16.c index ee5f639b8e..f87ea0e5b3 100644 --- a/lib/librte_table/rte_table_hash_key16.c +++ b/lib/librte_table/rte_table_hash_key16.c @@ -535,9 +535,8 @@ rte_table_hash_entry_delete_key16_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_16)); - bucket_index = (bucket - - ((struct rte_bucket_4_16 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } diff --git a/lib/librte_table/rte_table_hash_key32.c b/lib/librte_table/rte_table_hash_key32.c index da0ce6af9f..6790594944 100644 --- a/lib/librte_table/rte_table_hash_key32.c +++ b/lib/librte_table/rte_table_hash_key32.c @@ -540,9 +540,8 @@ rte_table_hash_entry_delete_key32_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_32)); - bucket_index = (bucket - - ((struct rte_bucket_4_32 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } diff --git a/lib/librte_table/rte_table_hash_key8.c b/lib/librte_table/rte_table_hash_key8.c index 443ca7da77..6803eb2ef7 100644 --- a/lib/librte_table/rte_table_hash_key8.c +++ b/lib/librte_table/rte_table_hash_key8.c @@ -528,9 +528,8 @@ rte_table_hash_entry_delete_key8_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_8)); - bucket_index = (bucket - - ((struct rte_bucket_4_8 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; }