diff mbox series

[v4,1/2] hash table: fix a bug in rte_hash_iterate()

Message ID 20181009192907.85650-1-qiaobinf@bu.edu (mailing list archive)
State Rejected, archived
Delegated to: Thomas Monjalon
Headers show
Series [v4,1/2] hash table: fix a bug in rte_hash_iterate() | expand

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Fu, Qiaobin Oct. 9, 2018, 7:29 p.m. UTC
In current implementation of rte_hash_iterate(), it
tries to obtain the lock after the while loop. However,
this may lead to a bug. Notice the following racing condition:

1. The while loop above finishes because it finds
   a not empty slot. But it does so without a lock.
2. Then we get the lock.
3. The position that was once not empty is now empty.
   BUG because next_key is invalid.

This patch fixes this small bug.

Signed-off-by: Qiaobin Fu <qiaobinf@bu.edu>
Reviewed-by: Michel Machado <michel@digirati.com.br>
---
 lib/librte_hash/rte_cuckoo_hash.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Wang, Yipeng1 Oct. 10, 2018, 1:55 a.m. UTC | #1
Hi Qiaobin,

This patch: http://patchwork.dpdk.org/patch/46105/ covers the bug.  Honnappa suggested a fix that would work well for the lock free implementation as well.

>-----Original Message-----
>From: Qiaobin Fu [mailto:qiaobinf@bu.edu]
>Sent: Tuesday, October 9, 2018 12:29 PM
>To: Richardson, Bruce <bruce.richardson@intel.com>; De Lara Guarch, Pablo <pablo.de.lara.guarch@intel.com>
>Cc: dev@dpdk.org; doucette@bu.edu; Wiles, Keith <keith.wiles@intel.com>; Gobriel, Sameh <sameh.gobriel@intel.com>; Tai, Charlie
><charlie.tai@intel.com>; stephen@networkplumber.org; nd@arm.com; honnappa.nagarahalli@arm.com; Wang, Yipeng1
><yipeng1.wang@intel.com>; michel@digirati.com.br; qiaobinf@bu.edu
>Subject: [PATCH v4 1/2] hash table: fix a bug in rte_hash_iterate()
>
>In current implementation of rte_hash_iterate(), it
>tries to obtain the lock after the while loop. However,
>this may lead to a bug. Notice the following racing condition:
>
>1. The while loop above finishes because it finds
>   a not empty slot. But it does so without a lock.
>2. Then we get the lock.
>3. The position that was once not empty is now empty.
>   BUG because next_key is invalid.
>
>This patch fixes this small bug.
>
>Signed-off-by: Qiaobin Fu <qiaobinf@bu.edu>
>Reviewed-by: Michel Machado <michel@digirati.com.br>
>---
> lib/librte_hash/rte_cuckoo_hash.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/lib/librte_hash/rte_cuckoo_hash.c b/lib/librte_hash/rte_cuckoo_hash.c
>index f7b86c8c9..a3e76684d 100644
>--- a/lib/librte_hash/rte_cuckoo_hash.c
>+++ b/lib/librte_hash/rte_cuckoo_hash.c
>@@ -1317,16 +1317,18 @@ rte_hash_iterate(const struct rte_hash *h, const void **key, void **data, uint32
> 	bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES;
> 	idx = *next % RTE_HASH_BUCKET_ENTRIES;
>
>+	__hash_rw_reader_lock(h);
> 	/* If current position is empty, go to the next one */
> 	while (h->buckets[bucket_idx].key_idx[idx] == EMPTY_SLOT) {
> 		(*next)++;
> 		/* End of table */
>-		if (*next == total_entries)
>+		if (*next == total_entries) {
>+			__hash_rw_reader_unlock(h);
> 			return -ENOENT;
>+		}
> 		bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES;
> 		idx = *next % RTE_HASH_BUCKET_ENTRIES;
> 	}
>-	__hash_rw_reader_lock(h);
> 	/* Get position of entry in key table */
> 	position = h->buckets[bucket_idx].key_idx[idx];
> 	next_key = (struct rte_hash_key *) ((char *)h->key_store +
>--
>2.17.1
diff mbox series

Patch

diff --git a/lib/librte_hash/rte_cuckoo_hash.c b/lib/librte_hash/rte_cuckoo_hash.c
index f7b86c8c9..a3e76684d 100644
--- a/lib/librte_hash/rte_cuckoo_hash.c
+++ b/lib/librte_hash/rte_cuckoo_hash.c
@@ -1317,16 +1317,18 @@  rte_hash_iterate(const struct rte_hash *h, const void **key, void **data, uint32
 	bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES;
 	idx = *next % RTE_HASH_BUCKET_ENTRIES;
 
+	__hash_rw_reader_lock(h);
 	/* If current position is empty, go to the next one */
 	while (h->buckets[bucket_idx].key_idx[idx] == EMPTY_SLOT) {
 		(*next)++;
 		/* End of table */
-		if (*next == total_entries)
+		if (*next == total_entries) {
+			__hash_rw_reader_unlock(h);
 			return -ENOENT;
+		}
 		bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES;
 		idx = *next % RTE_HASH_BUCKET_ENTRIES;
 	}
-	__hash_rw_reader_lock(h);
 	/* Get position of entry in key table */
 	position = h->buckets[bucket_idx].key_idx[idx];
 	next_key = (struct rte_hash_key *) ((char *)h->key_store +