From eb3e2c11830e4d75ff5dff20cfa70599a1613f71 Mon Sep 17 00:00:00 2001 From: Cristian Dumitrescu Date: Thu, 10 Feb 2022 19:45:08 +0000 Subject: [PATCH] pipeline: fix table state memory allocation The regular tables, selector tables and learner tables are all sharing the table state array. The locations in this array were computed incorrectly, leading to memory corruption issues. Fixes: 4f59d3726147 ("pipeline: support learner tables") Cc: stable@dpdk.org Signed-off-by: Cristian Dumitrescu Signed-off-by: Harshad Narayane Signed-off-by: Kamalakannan R Signed-off-by: Venkata Suresh Kumar P --- lib/pipeline/rte_swx_ctl.c | 28 +++++++++++++++++----------- lib/pipeline/rte_swx_pipeline.c | 2 +- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/lib/pipeline/rte_swx_ctl.c b/lib/pipeline/rte_swx_ctl.c index 8e29d58cec..f52ccffd75 100644 --- a/lib/pipeline/rte_swx_ctl.c +++ b/lib/pipeline/rte_swx_ctl.c @@ -1021,15 +1021,16 @@ learner_action_data_size_get(struct rte_swx_ctl_pipeline *ctl, struct learner *l static void table_state_free(struct rte_swx_ctl_pipeline *ctl) { - uint32_t i; + uint32_t table_base_index, selector_base_index, learner_base_index, i; if (!ctl->ts_next) return; /* For each table, free its table state. */ + table_base_index = 0; for (i = 0; i < ctl->info.n_tables; i++) { struct table *table = &ctl->tables[i]; - struct rte_swx_table_state *ts = &ctl->ts_next[i]; + struct rte_swx_table_state *ts = &ctl->ts_next[table_base_index + i]; /* Default action data. */ free(ts->default_action_data); @@ -1040,8 +1041,9 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl) } /* For each selector table, free its table state. */ + selector_base_index = ctl->info.n_tables; for (i = 0; i < ctl->info.n_selectors; i++) { - struct rte_swx_table_state *ts = &ctl->ts_next[i]; + struct rte_swx_table_state *ts = &ctl->ts_next[selector_base_index + i]; /* Table object. */ if (ts->obj) @@ -1049,8 +1051,9 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl) } /* For each learner table, free its table state. */ + learner_base_index = ctl->info.n_tables + ctl->info.n_selectors; for (i = 0; i < ctl->info.n_learners; i++) { - struct rte_swx_table_state *ts = &ctl->ts_next[i]; + struct rte_swx_table_state *ts = &ctl->ts_next[learner_base_index + i]; /* Default action data. */ free(ts->default_action_data); @@ -1063,10 +1066,10 @@ table_state_free(struct rte_swx_ctl_pipeline *ctl) static int table_state_create(struct rte_swx_ctl_pipeline *ctl) { + uint32_t table_base_index, selector_base_index, learner_base_index, i; int status = 0; - uint32_t i; - ctl->ts_next = calloc(ctl->info.n_tables + ctl->info.n_selectors, + ctl->ts_next = calloc(ctl->info.n_tables + ctl->info.n_selectors + ctl->info.n_learners, sizeof(struct rte_swx_table_state)); if (!ctl->ts_next) { status = -ENOMEM; @@ -1074,10 +1077,11 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl) } /* Tables. */ + table_base_index = 0; for (i = 0; i < ctl->info.n_tables; i++) { struct table *table = &ctl->tables[i]; - struct rte_swx_table_state *ts = &ctl->ts[i]; - struct rte_swx_table_state *ts_next = &ctl->ts_next[i]; + struct rte_swx_table_state *ts = &ctl->ts[table_base_index + i]; + struct rte_swx_table_state *ts_next = &ctl->ts_next[table_base_index + i]; /* Table object. */ if (!table->is_stub && table->ops.add) { @@ -1110,9 +1114,10 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl) } /* Selector tables. */ + selector_base_index = ctl->info.n_tables; for (i = 0; i < ctl->info.n_selectors; i++) { struct selector *s = &ctl->selectors[i]; - struct rte_swx_table_state *ts_next = &ctl->ts_next[ctl->info.n_tables + i]; + struct rte_swx_table_state *ts_next = &ctl->ts_next[selector_base_index + i]; /* Table object. */ ts_next->obj = rte_swx_table_selector_create(&s->params, NULL, ctl->numa_node); @@ -1123,10 +1128,11 @@ table_state_create(struct rte_swx_ctl_pipeline *ctl) } /* Learner tables. */ + learner_base_index = ctl->info.n_tables + ctl->info.n_selectors; for (i = 0; i < ctl->info.n_learners; i++) { struct learner *l = &ctl->learners[i]; - struct rte_swx_table_state *ts = &ctl->ts[i]; - struct rte_swx_table_state *ts_next = &ctl->ts_next[i]; + struct rte_swx_table_state *ts = &ctl->ts[learner_base_index + i]; + struct rte_swx_table_state *ts_next = &ctl->ts_next[learner_base_index + i]; /* Table object: duplicate from the current table state. */ ts_next->obj = ts->obj; diff --git a/lib/pipeline/rte_swx_pipeline.c b/lib/pipeline/rte_swx_pipeline.c index 1a50c4bb72..f404ff1596 100644 --- a/lib/pipeline/rte_swx_pipeline.c +++ b/lib/pipeline/rte_swx_pipeline.c @@ -8567,7 +8567,7 @@ table_state_build(struct rte_swx_pipeline *p) struct selector *s; struct learner *l; - p->table_state = calloc(p->n_tables + p->n_selectors, + p->table_state = calloc(p->n_tables + p->n_selectors + p->n_learners, sizeof(struct rte_swx_table_state)); CHECK(p->table_state, ENOMEM); -- 2.39.5