pipeline: fix table state memory allocation

The regular tables, selector tables and learner tables are all sharing
the table state array. The locations in this array were computed
incorrectly, leading to memory corruption issues.

Fixes: 4f59d3726147 ("pipeline: support learner tables")
Cc: stable@dpdk.org
Signed-off-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>
Signed-off-by: Harshad Narayane <harshad.suresh.narayane@intel.com>
Signed-off-by: Kamalakannan R <kamalakannan.r@intel.com>
Signed-off-by: Venkata Suresh Kumar P <venkata.suresh.kumar.p@intel.com>

diff --git a/lib/pipeline/rte_swx_ctl.c b/lib/pipeline/rte_swx_ctl.c
index 8e29d58cec7070e7a58fb8aab96cde2b55f9ac67..f52ccffd75a41718cc8dd8e96a5f8f17d0ba56d9 100644 (file)
--- a/lib/pipeline/rte_swx_ctl.c
+++ b/lib/pipeline/rte_swx_ctl.c
@@ -1021,15 +1021,16 @@ learner_action_data_size_get(struct rte_swx_ctl_pipeline *ctl, struct learner *l
 static void
 table_state_free(struct rte_swx_ctl_pipeline *ctl)
 {
-       uint32_t i;
+       uint32_t table_base_index, selector_base_index, learner_base_index, i;
 
        if (!ctl->ts_next)
                return;
 
        /* For each table, free its table state. */
+       table_base_index = 0;
        for (i = 0; i < ctl->info.n_tables; i++) {
                struct table *table = &ctl->tables[i];
-               struct rte_swx_table_state *ts = &ctl->ts_next[i];
+               struct rte_swx_table_state *ts = &ctl->ts_next[table_base_index + i];
 
                /* Default action data. */
                free(ts->default_action_data);
@@ -1040,8 +1041,9 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl)
        }
 
        /* For each selector table, free its table state. */
+       selector_base_index = ctl->info.n_tables;
        for (i = 0; i < ctl->info.n_selectors; i++) {
-               struct rte_swx_table_state *ts = &ctl->ts_next[i];
+               struct rte_swx_table_state *ts = &ctl->ts_next[selector_base_index + i];
 
                /* Table object. */
                if (ts->obj)
@@ -1049,8 +1051,9 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl)
        }
 
        /* For each learner table, free its table state. */
+       learner_base_index = ctl->info.n_tables + ctl->info.n_selectors;
        for (i = 0; i < ctl->info.n_learners; i++) {
-               struct rte_swx_table_state *ts = &ctl->ts_next[i];
+               struct rte_swx_table_state *ts = &ctl->ts_next[learner_base_index + i];
 
                /* Default action data. */
                free(ts->default_action_data);
@@ -1063,10 +1066,10 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl)
 static int
 table_state_create(struct rte_swx_ctl_pipeline *ctl)
 {
+       uint32_t table_base_index, selector_base_index, learner_base_index, i;
        int status = 0;
-       uint32_t i;
 
-       ctl->ts_next = calloc(ctl->info.n_tables + ctl->info.n_selectors,
+       ctl->ts_next = calloc(ctl->info.n_tables + ctl->info.n_selectors + ctl->info.n_learners,
                              sizeof(struct rte_swx_table_state));
        if (!ctl->ts_next) {
                status = -ENOMEM;
@@ -1074,10 +1077,11 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl)
        }
 
        /* Tables. */
+       table_base_index = 0;
        for (i = 0; i < ctl->info.n_tables; i++) {
                struct table *table = &ctl->tables[i];
-               struct rte_swx_table_state *ts = &ctl->ts[i];
-               struct rte_swx_table_state *ts_next = &ctl->ts_next[i];
+               struct rte_swx_table_state *ts = &ctl->ts[table_base_index + i];
+               struct rte_swx_table_state *ts_next = &ctl->ts_next[table_base_index + i];
 
                /* Table object. */
                if (!table->is_stub && table->ops.add) {
@@ -1110,9 +1114,10 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl)
        }
 
        /* Selector tables. */
+       selector_base_index = ctl->info.n_tables;
        for (i = 0; i < ctl->info.n_selectors; i++) {
                struct selector *s = &ctl->selectors[i];
-               struct rte_swx_table_state *ts_next = &ctl->ts_next[ctl->info.n_tables + i];
+               struct rte_swx_table_state *ts_next = &ctl->ts_next[selector_base_index + i];
 
                /* Table object. */
                ts_next->obj = rte_swx_table_selector_create(&s->params, NULL, ctl->numa_node);
@@ -1123,10 +1128,11 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl)
        }
 
        /* Learner tables. */
+       learner_base_index = ctl->info.n_tables + ctl->info.n_selectors;
        for (i = 0; i < ctl->info.n_learners; i++) {
                struct learner *l = &ctl->learners[i];
-               struct rte_swx_table_state *ts = &ctl->ts[i];
-               struct rte_swx_table_state *ts_next = &ctl->ts_next[i];
+               struct rte_swx_table_state *ts = &ctl->ts[learner_base_index + i];
+               struct rte_swx_table_state *ts_next = &ctl->ts_next[learner_base_index + i];
 
                /* Table object: duplicate from the current table state. */
                ts_next->obj = ts->obj;

diff --git a/lib/pipeline/rte_swx_pipeline.c b/lib/pipeline/rte_swx_pipeline.c
index 1a50c4bb7248a33d3f28eb29bca49e5ea2dacb6f..f404ff1596372585223b374184fa2803b3ad36a6 100644 (file)
--- a/lib/pipeline/rte_swx_pipeline.c
+++ b/lib/pipeline/rte_swx_pipeline.c
@@ -8567,7 +8567,7 @@ table_state_build(struct rte_swx_pipeline *p)
        struct selector *s;
        struct learner *l;
 
-       p->table_state = calloc(p->n_tables + p->n_selectors,
+       p->table_state = calloc(p->n_tables + p->n_selectors + p->n_learners,
                                sizeof(struct rte_swx_table_state));
        CHECK(p->table_state, ENOMEM);