From 2f95a470b80df115a0a0c9fba4bfbae73f4d66ae Mon Sep 17 00:00:00 2001 From: Miroslaw Walukiewicz Date: Tue, 3 Mar 2015 09:16:00 -0500 Subject: [PATCH] table: fix crash during key overload hash_key8_ext, hash_key16_ext and hash_key32_ext tables allocate cache entries to support table overload cases. The crash can occur when cache entry is free after use. The problem is with computing the index of the free cache entry. Signed-off-by: Mirek Walukiewicz Signed-off-by: Maciej Gajdzica Acked-by: Cristian Dumitrescu --- lib/librte_table/rte_table_hash_key16.c | 5 ++--- lib/librte_table/rte_table_hash_key32.c | 5 ++--- lib/librte_table/rte_table_hash_key8.c | 5 ++--- 3 files changed, 6 insertions(+), 9 deletions(-) diff --git a/lib/librte_table/rte_table_hash_key16.c b/lib/librte_table/rte_table_hash_key16.c index ee5f639b8e..f87ea0e5b3 100644 --- a/lib/librte_table/rte_table_hash_key16.c +++ b/lib/librte_table/rte_table_hash_key16.c @@ -535,9 +535,8 @@ rte_table_hash_entry_delete_key16_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_16)); - bucket_index = (bucket - - ((struct rte_bucket_4_16 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } diff --git a/lib/librte_table/rte_table_hash_key32.c b/lib/librte_table/rte_table_hash_key32.c index da0ce6af9f..6790594944 100644 --- a/lib/librte_table/rte_table_hash_key32.c +++ b/lib/librte_table/rte_table_hash_key32.c @@ -540,9 +540,8 @@ rte_table_hash_entry_delete_key32_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_32)); - bucket_index = (bucket - - ((struct rte_bucket_4_32 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } diff --git a/lib/librte_table/rte_table_hash_key8.c b/lib/librte_table/rte_table_hash_key8.c index 443ca7da77..6803eb2ef7 100644 --- a/lib/librte_table/rte_table_hash_key8.c +++ b/lib/librte_table/rte_table_hash_key8.c @@ -528,9 +528,8 @@ rte_table_hash_entry_delete_key8_ext( memset(bucket, 0, sizeof(struct rte_bucket_4_8)); - bucket_index = (bucket - - ((struct rte_bucket_4_8 *) - f->memory)) - f->n_buckets; + bucket_index = (((uint8_t *)bucket - + (uint8_t *)f->memory)/f->bucket_size) - f->n_buckets; f->stack[f->stack_pos++] = bucket_index; } -- 2.20.1