From 039f289e516b073f6db67f7b35aa3aa64fdc9c82 Mon Sep 17 00:00:00 2001 From: Jieqiang Wang Date: Thu, 29 Jul 2021 17:03:16 +0000 Subject: vppinfra: fix potential memory access error in _pool_init_fixed _pool_init_fixed uses mmap to initialize a fixed-size and preallocated pool, whose size is the sum of vector_size and free_index_size with alignment to the CLIB_CACHE_LINE_BYTES and page size. In this way vector_size equals to pool_header_t + vec_header_t + elt_size * max_elts so moving to the end of the pool space should be pool_header_t pointer + vector_size, instead of vec_header_t pointer + vector_size. Simple code to reproduce this error: u64 *pool; pool_init_fixed(pool, 2042); Improve unit test to cover this case Type: fix Signed-off-by: Jieqiang Wang Reviewed-by: Lijian Zhang Reviewed-by: Tianyu Li Change-Id: If088ef89b3dcb2d874ee837ae9da60983b14615c Signed-off-by: Dave Barach --- src/plugins/unittest/pool_test.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) (limited to 'src/plugins') diff --git a/src/plugins/unittest/pool_test.c b/src/plugins/unittest/pool_test.c index 237b6beea09..23ac6d6d95f 100644 --- a/src/plugins/unittest/pool_test.c +++ b/src/plugins/unittest/pool_test.c @@ -19,29 +19,37 @@ static clib_error_t * test_pool_command_fn (vlib_main_t *vm, unformat_input_t *input, vlib_cli_command_t *cmd) { - int i; + static int sizes[] = { 3, 31, 2042, 2048 }; + + int i, j; u64 *pool; + uword this_size; - pool_init_fixed (pool, 2048); + for (j = 0; j < ARRAY_LEN (sizes); j++) + { + this_size = sizes[j]; - i = 0; + pool_init_fixed (pool, this_size); - while (pool_free_elts (pool) > 0) - { - u64 *p __attribute__ ((unused)); + i = 0; - pool_get (pool, p); - i++; - } + while (pool_free_elts (pool) > 0) + { + u64 *p __attribute__ ((unused)); - vlib_cli_output (vm, "allocated %d elts\n", i); + pool_get (pool, p); + i++; + } - for (--i; i >= 0; i--) - { - pool_put_index (pool, i); - } + vlib_cli_output (vm, "allocated %d elts\n", i); - ALWAYS_ASSERT (pool_free_elts (pool) == 2048); + for (--i; i >= 0; i--) + { + pool_put_index (pool, i); + } + + ALWAYS_ASSERT (pool_free_elts (pool) == this_size); + } vlib_cli_output (vm, "Test succeeded...\n"); return 0; -- cgit 1.2.3-korg