diff options
| author |   Ole Troan <ot@cisco.com> | 2020-10-21 11:55:28 +0200 |
|---|---|---|
| committer |   Elias Rudberg <elias.rudberg@bahnhof.net> | 2020-11-30 20:43:08 +0100 |
| commit | 007bd2f1fe3a29a8600462af74cf3b1b077fdf30 (patch) | |
| tree | 7f34d3dd2a807d537649b268c20aab554156fef0 /src/vpp-api/client/stat_client.h | |
| parent | e7a1006e867029206535510576fb754398affede (diff) | |
stats: missing dimension in stat_set_simple_counter
A simple counter is a two dimensional array by threads and
counter index. 28017 introduced an error missing the first
dimension.
If a vector is updated at the same time as a client reads,
an invalid pointer my result. This will be caught by the
optimistic locking after copying out the data, but if
following a pointer outside of the stat segment then
the stat client would crash. Add suitable boundary checks
for access to stat memory segment.
Fixes: 7d29e320fb2855a1ddb7a6af09078b8ed636de01
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I94f124ec71d98218c4eda5d124ac5594743d93d6
(cherry picked from commit 65c56c83ce4e58178b5ad90a8f325692c9904381)
Signed-off-by: Elias Rudberg <elias.rudberg@bahnhof.net>
Diffstat (limited to 'src/vpp-api/client/stat_client.h')
| -rw-r--r-- | src/vpp-api/client/stat_client.h | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/vpp-api/client/stat_client.h b/src/vpp-api/client/stat_client.h index c5fa5597758..b2457ad6e48 100644 --- a/src/vpp-api/client/stat_client.h +++ b/src/vpp-api/client/stat_client.h @@ -101,8 +101,13 @@ _time_now_nsec (void) static inline void * stat_segment_adjust (stat_client_main_t * sm, void *data) { - return (void *) ((char *) sm->shared_header + - ((char *) data - (char *) sm->shared_header->base)); + void *p = (void *) ((char *) sm->shared_header + + ((char *) data - (char *) sm->shared_header->base)); + if ((char *) p > (char *) sm->shared_header && + (((char *) p + sizeof (p)) < + ((char *) sm->shared_header + sm->memory_size))) + return p; + return 0; } /* |