From: Xiaolong Ye Date: Sat, 13 Jun 2020 15:49:17 +0000 (+0800) Subject: mbuf: fix boundary check at dynamic field registration X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=f8eb26dda8bfc806ff71f65966dc17210686fc20;p=dpdk.git mbuf: fix boundary check at dynamic field registration We should make sure off + size < sizeof(struct rte_mbuf) to avoid possible out-of-bounds access of free_space array, there is no issue currently due to the low bits of free_flags (which is adjacent to free_space) are always set to 0. But we shouldn't rely on it since it's fragile and layout of struct mbuf_dyn_shm may be changed in the future. This patch adds boundary check explicitly to avoid potential risk of out-of-bounds access. Fixes: 4958ca3a443a ("mbuf: support dynamic fields and flags") Cc: stable@dpdk.org Signed-off-by: Xiaolong Ye Acked-by: Olivier Matz --- diff --git a/lib/librte_mbuf/rte_mbuf_dyn.c b/lib/librte_mbuf/rte_mbuf_dyn.c index 953e3ec31c..13d6da6d16 100644 --- a/lib/librte_mbuf/rte_mbuf_dyn.c +++ b/lib/librte_mbuf/rte_mbuf_dyn.c @@ -69,7 +69,8 @@ process_score(void) for (off = 0; off < sizeof(struct rte_mbuf); off++) { /* get the size of the free zone */ - for (size = 0; shm->free_space[off + size]; size++) + for (size = 0; (off + size) < sizeof(struct rte_mbuf) && + shm->free_space[off + size]; size++) ; if (size == 0) continue;