table: fix crash during key overload

hash_key8_ext, hash_key16_ext and hash_key32_ext tables allocate cache
entries to support table overload cases. The crash can occur when cache
entry is free after use.
The problem is with computing the index of the free cache entry.

Signed-off-by: Mirek Walukiewicz <miroslaw.walukiewicz@intel.com>
Signed-off-by: Maciej Gajdzica <maciejx.t.gajdzica@intel.com>
Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>

diff --git a/lib/librte_table/rte_table_hash_key16.c b/lib/librte_table/rte_table_hash_key16.c
index ee5f639..f87ea0e 100644 (file)
--- a/lib/librte_table/rte_table_hash_key16.c
+++ b/lib/librte_table/rte_table_hash_key16.c
@@ -535,9 +535,8 @@ rte_table_hash_entry_delete_key16_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_16));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_16 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }
 

diff --git a/lib/librte_table/rte_table_hash_key32.c b/lib/librte_table/rte_table_hash_key32.c
index da0ce6a..6790594 100644 (file)
--- a/lib/librte_table/rte_table_hash_key32.c
+++ b/lib/librte_table/rte_table_hash_key32.c
@@ -540,9 +540,8 @@ rte_table_hash_entry_delete_key32_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_32));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_32 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }
 

diff --git a/lib/librte_table/rte_table_hash_key8.c b/lib/librte_table/rte_table_hash_key8.c
index 443ca7d..6803eb2 100644 (file)
--- a/lib/librte_table/rte_table_hash_key8.c
+++ b/lib/librte_table/rte_table_hash_key8.c
@@ -528,9 +528,8 @@ rte_table_hash_entry_delete_key8_ext(
 
                                        memset(bucket, 0,
                                                sizeof(struct rte_bucket_4_8));
-                                       bucket_index = (bucket -
-                                               ((struct rte_bucket_4_8 *)
-                                               f->memory)) - f->n_buckets;
+                                       bucket_index = (((uint8_t *)bucket -
+                                               (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets;
                                        f->stack[f->stack_pos++] = bucket_index;
                                }