diff options
| author |   Ole Troan <ot@cisco.com> | 2020-10-21 11:55:28 +0200 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2020-10-21 18:58:58 +0000 |
| commit | 65c56c83ce4e58178b5ad90a8f325692c9904381 (patch) | |
| tree | 606128e07913c4221bb1e867cf39aa06b80238b1 /src/vpp | |
| parent | 7ff514b32c8b41366b408acf2c535298546c6d42 (diff) | |
stats: missing dimension in stat_set_simple_counter
A simple counter is a two dimensional array by threads and
counter index. 28017 introduced an error missing the first
dimension.
If a vector is updated at the same time as a client reads,
an invalid pointer my result. This will be caught by the
optimistic locking after copying out the data, but if
following a pointer outside of the stat segment then
the stat client would crash. Add suitable boundary checks
for access to stat memory segment.
Fixes: 7d29e320fb2855a1ddb7a6af09078b8ed636de01
Type: fix
Signed-off-by: Ole Troan <ot@cisco.com>
Change-Id: I94f124ec71d98218c4eda5d124ac5594743d93d6
Diffstat (limited to 'src/vpp')
| -rw-r--r-- | src/vpp/stats/stat_segment.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/vpp/stats/stat_segment.c b/src/vpp/stats/stat_segment.c index b060969f04f..4244acb1dd0 100644 --- a/src/vpp/stats/stat_segment.c +++ b/src/vpp/stats/stat_segment.c @@ -281,7 +281,8 @@ stat_set_simple_counter (stat_segment_directory_entry_t * ep, u32 thread_index, u32 index, u64 value) { ASSERT (ep->data); - counter_t *cb = ep->data; + counter_t **counters = ep->data; + counter_t *cb = counters[thread_index]; cb[index] = value; } |