mempool: fix corruption due to invalid handler

When using rte_mempool_create(), the mempool handler is selected
depending on the flags given by the user:
  - multi-consumer / multi-producer
  - multi-consumer / single-producer
  - single-consumer / multi-producer
  - single-consumer / single-producer

The flags were not properly tested, resulting in the selection of sc/sp
handler if sc/mp or mc/sp was asked. This can lead to corruption or
crashes because the get/put operations are not atomic.

Fixes: 449c49b93a6b ("mempool: support handler operations")

Signed-off-by: Weiliang Luo <droidluo@gmail.com>
Acked-by: Olivier Matz <olivier.matz@6wind.com>

diff --git a/lib/librte_mempool/rte_mempool.c b/lib/librte_mempool/rte_mempool.c
index 1f17316..df8b68c 100644 (file)
--- a/lib/librte_mempool/rte_mempool.c
+++ b/lib/librte_mempool/rte_mempool.c
@@ -878,7 +878,7 @@ rte_mempool_create(const char *name, unsigned n, unsigned elt_size,
         * Since we have 4 combinations of the SP/SC/MP/MC examine the flags to
         * set the correct index into the table of ops structs.
         */
-       if (flags & (MEMPOOL_F_SP_PUT | MEMPOOL_F_SC_GET))
+       if ((flags & MEMPOOL_F_SP_PUT) && (flags & MEMPOOL_F_SC_GET))
                rte_mempool_set_ops_byname(mp, "ring_sp_sc", NULL);
        else if (flags & MEMPOOL_F_SP_PUT)
                rte_mempool_set_ops_byname(mp, "ring_sp_mc", NULL);