table: fix crash during key overload

hash_key8_ext, hash_key16_ext and hash_key32_ext tables allocate cache
entries to support table overload cases. The crash can occur when cache
entry is free after use.
The problem is with computing the index of the free cache entry.

Signed-off-by: Mirek Walukiewicz <miroslaw.walukiewicz@intel.com>
Signed-off-by: Maciej Gajdzica <maciejx.t.gajdzica@intel.com>
Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>

diff --git a/lib/librte_table/rte_table_hash_key16.c b/lib/librte_table/rte_table_hash_key16.c
index ee5f639b8ee86827c7e77115d86172e7cde6ab5c..f87ea0e5b3401baf13fda08b601dbe29084f5e20 100644 (file)
--- a/lib/librte_table/rte_table_hash_key16.c
+++ b/lib/librte_table/rte_table_hash_key16.c
@@ -535,9 +535,8 @@ rte_table_hash_entry_delete_key16_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_16));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_16 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }
 

diff --git a/lib/librte_table/rte_table_hash_key32.c b/lib/librte_table/rte_table_hash_key32.c
index da0ce6af9f4fd25aff2a3402649ba7ea91ca3cad..6790594944b548e998f8a9c64b9269525c1c26c7 100644 (file)
--- a/lib/librte_table/rte_table_hash_key32.c
+++ b/lib/librte_table/rte_table_hash_key32.c
@@ -540,9 +540,8 @@ rte_table_hash_entry_delete_key32_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_32));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_32 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }
 

diff --git a/lib/librte_table/rte_table_hash_key8.c b/lib/librte_table/rte_table_hash_key8.c
index 443ca7da7793a9a0ada15debb0c8faba79bd4d27..6803eb2ef70ad42f04fb4dc552df7706e56ca47e 100644 (file)
--- a/lib/librte_table/rte_table_hash_key8.c
+++ b/lib/librte_table/rte_table_hash_key8.c
@@ -528,9 +528,8 @@ rte_table_hash_entry_delete_key8_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_8));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_8 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }