From patchwork Tue Dec 14 03:30:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?546L5b+X5a6P?= X-Patchwork-Id: 105122 X-Patchwork-Delegate: david.marchand@redhat.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 8CED0A034C; Tue, 14 Dec 2021 04:30:24 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C99C040E28; Tue, 14 Dec 2021 04:30:23 +0100 (CET) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mails.dpdk.org (Postfix) with ESMTP id 9D8E440395 for ; Tue, 14 Dec 2021 04:30:22 +0100 (CET) Received: by mail-pj1-f44.google.com with SMTP id gx15-20020a17090b124f00b001a695f3734aso15046064pjb.0 for ; Mon, 13 Dec 2021 19:30:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=JkMkaWItrlWwJh03faN7J8FmFgxH4iCw8zl5yiPvPJ8=; b=C+akNtDiun+DFZRdd5XRDWErwGN/HX+4kz23AL4l1MYG6kXQNJd1317XNDtqDkqZrr mtUlS/lVEsWcTpoeXiVKVp5GBhtayPBxrQadZZ2hLNSnJODCzqLpk0lOd0TtQEFK1xoL RtcG2Aq1FIf+d7NfBESseMcGjoZ4NiOCDfbKtscZx5gTmiWRH0n/gNYZeSss/Dj9ErOk WNXuNhYcVM8zcewFK8pV8ME/LiOQhvHMl+qBpKGTT3+m50S/RbZL9pqXkvACpHPfvfsm MK+ieU3QvG07g2xnlKbvod8pvW10mCuqv6gvq8i2c+0+eWPfhIQhRfMXQO+FJ5YRnbBa txSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=JkMkaWItrlWwJh03faN7J8FmFgxH4iCw8zl5yiPvPJ8=; b=XzFc0GhRhnm8msOZP2NVbpqE85LVq6aAfHIKD/ECXQgMhlbvSIwdSL1hMJn0PV9U/c B36ZLts81nZVNB+As20q6WNq51maEcKRODqFsmmvXYp37a7yRsXk9+bHviugNUZ8dUj4 CYBNdvra3SPNvviXgDmUpWhKQeCo+Rhd95pZI5kc17/UUcTV18NB4BpPfX9hNlCYoD9p ZXfcr33RBZceX3NGzbPlb0FDEL2DDaoZisL0BqxRHddOsauDF93gcUyhjCxFYOW+gBzA Ji37/LTmw7vplBJAM1oqYcOZD+1RTD0/R75TIBF8QuDCOV9Lmy4TSbHwUjVO2AEIb94W Uc+A== X-Gm-Message-State: AOAM531ak/aoZEtiuAi9JZsriRwGdTSA3/ay9omkkoaPIgE46y0fN9hk V80yMG19Vks37803UHEvVPCXCg== X-Google-Smtp-Source: ABdhPJxTqDIs0JODS9q2poTPPDxds1WDTIDxtQPRDadfSyrJHpKDVtsLnT5QPZif2+f1r+TYQ84zZg== X-Received: by 2002:a17:902:c7c2:b0:143:bdf7:1670 with SMTP id r2-20020a170902c7c200b00143bdf71670mr3200738pla.61.1639452621680; Mon, 13 Dec 2021 19:30:21 -0800 (PST) Received: from C02D70YZMD6R.bytedance.net ([139.177.225.234]) by smtp.gmail.com with ESMTPSA id l1sm501691pjh.28.2021.12.13.19.30.19 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Dec 2021 19:30:21 -0800 (PST) From: Zhihong Wang To: konstantin.ananyev@intel.com, honnappa.nagarahalli@arm.com, dev@dpdk.org Cc: Zhihong Wang , stable@dpdk.org Subject: [PATCH] ring: fix overflow in memory size calcuation Date: Tue, 14 Dec 2021 11:30:16 +0800 Message-Id: <20211214033016.29927-1-wangzhihong.wzh@bytedance.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Parameters count and esize are both unsigned int, and their product can legally exceed unsigned int and lead to runtime access violation. Fixes: cc4b218790f6 ("ring: support configurable element size") Cc: stable@dpdk.org Signed-off-by: Zhihong Wang Reviewed-by: Morten Brørup Acked-by: Konstantin Ananyev Reviewed-by: Liang Ma Reviewed-by: Morten Brørup Acked-by: Konstantin Ananyev --- lib/ring/rte_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ring/rte_ring.c b/lib/ring/rte_ring.c index f17bd966be..d1b80597af 100644 --- a/lib/ring/rte_ring.c +++ b/lib/ring/rte_ring.c @@ -75,7 +75,7 @@ rte_ring_get_memsize_elem(unsigned int esize, unsigned int count) return -EINVAL; } - sz = sizeof(struct rte_ring) + count * esize; + sz = sizeof(struct rte_ring) + (ssize_t)count * esize; sz = RTE_ALIGN(sz, RTE_CACHE_LINE_SIZE); return sz; }