lpm: fix use after free
authorChristian Ehrhardt <christian.ehrhardt@canonical.com>
Mon, 21 Mar 2016 14:06:14 +0000 (15:06 +0100)
committerThomas Monjalon <thomas.monjalon@6wind.com>
Tue, 22 Mar 2016 16:55:16 +0000 (17:55 +0100)
There were further chances for a use after free by returning an already
freed pointer in rte_lpm_create for v20 and v1604.
Along that is also makes the RTE_LOG messages of the failed allocations
unique.

Fixes: f1f7261838b3 ("lpm: add a new config structure for IPv4")

Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Acked-by: Olivier Matz <olivier.matz@6wind.com>
lib/librte_lpm/rte_lpm.c

index 3dee15c..af5811c 100644 (file)
@@ -303,8 +303,9 @@ rte_lpm_create_v1604(const char *name, int socket_id,
                        (size_t)rules_size, RTE_CACHE_LINE_SIZE, socket_id);
 
        if (lpm->rules_tbl == NULL) {
-               RTE_LOG(ERR, LPM, "LPM memory allocation failed\n");
+               RTE_LOG(ERR, LPM, "LPM rules_tbl memory allocation failed\n");
                rte_free(lpm);
+               lpm = NULL;
                rte_free(te);
                goto exit;
        }
@@ -313,8 +314,9 @@ rte_lpm_create_v1604(const char *name, int socket_id,
                        (size_t)tbl8s_size, RTE_CACHE_LINE_SIZE, socket_id);
 
        if (lpm->tbl8 == NULL) {
-               RTE_LOG(ERR, LPM, "LPM memory allocation failed\n");
+               RTE_LOG(ERR, LPM, "LPM tbl8 memory allocation failed\n");
                rte_free(lpm);
+               lpm = NULL;
                rte_free(te);
                goto exit;
        }