From patchwork Mon Mar 21 14:06:11 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Ehrhardt X-Patchwork-Id: 11626 X-Patchwork-Delegate: thomas@monjalon.net Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 66C462C6B; Mon, 21 Mar 2016 15:06:30 +0100 (CET) Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by dpdk.org (Postfix) with ESMTP id EADBC2C48 for ; Mon, 21 Mar 2016 15:06:27 +0100 (CET) Received: from 1.general.mandel.uk.vpn ([10.172.196.172] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1ai0TS-0002zo-UU; Mon, 21 Mar 2016 14:06:26 +0000 From: Christian Ehrhardt To: christian.ehrhardt@canonical.com, bruce.richardson@intel.com, dev@dpdk.org, olivier.matz@6wind.com Date: Mon, 21 Mar 2016 15:06:11 +0100 Message-Id: <1458569175-8742-2-git-send-email-christian.ehrhardt@canonical.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1458569175-8742-1-git-send-email-christian.ehrhardt@canonical.com> References: <1458131629-21925-1-git-send-email-christian.ehrhardt@canonical.com> <1458569175-8742-1-git-send-email-christian.ehrhardt@canonical.com> Subject: [dpdk-dev] [PATCH v4 1/5] lpm6: fix use after free of lpm in rte_lpm6_create X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In certain autotests lpm->max_rules turned out to be non initialized. That was caused by a failing allocation for lpm->rules_tbl in rte_lpm6_create. It then left the function via goto exit with lpm freed, but still a pointer value being set. In case of an allocation failure it resets lpm to NULL now, to avoid the upper layers operate on that already freed memory. Along that is also makes the RTE_LOG message of the failed allocation unique. Acked-by: Stephen Hemminger Acked-by: Olivier Matz Signed-off-by: Christian Ehrhardt --- lib/librte_lpm/rte_lpm6.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/librte_lpm/rte_lpm6.c b/lib/librte_lpm/rte_lpm6.c index 6c2b293..48931cc 100644 --- a/lib/librte_lpm/rte_lpm6.c +++ b/lib/librte_lpm/rte_lpm6.c @@ -206,8 +206,9 @@ rte_lpm6_create(const char *name, int socket_id, (size_t)rules_size, RTE_CACHE_LINE_SIZE, socket_id); if (lpm->rules_tbl == NULL) { - RTE_LOG(ERR, LPM, "LPM memory allocation failed\n"); + RTE_LOG(ERR, LPM, "LPM rules_tbl allocation failed\n"); rte_free(lpm); + lpm = NULL; rte_free(te); goto exit; }