[v2] graph: fix out of bounds access when re-allocate node objs

  For __rte_node_enqueue_prologue(), If the number of objs is more than
the node->size * 2, the extra objs will write out of bounds memory.
It should use __rte_node_stream_alloc_size() to request enough memory.

And for rte_node_next_stream_put(), it will re-allocate a small size,
when the node free space is small and new objs is less than the current
node->size. Some objs pointers behind new size may be lost. And it will
cause memory leak. It should request enough size of memory, containing
the original objs and new objs at least.

Fixes: 40d4f51403ec ("graph: implement fastpath routines")

Signed-off-by: Zhirun Yan <zhirun.yan@intel.com>
Signed-off-by: Cunming Liang <cunming.liang@intel.com>
---
 lib/graph/rte_graph_worker.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
  

> -----Original Message-----
> From: Zhirun Yan <zhirun.yan@intel.com>
> Sent: Thursday, August 4, 2022 11:33 AM
> To: dev@dpdk.org; Jerin Jacob Kollanukkaran <jerinj@marvell.com>; Kiran
> Kumar Kokkilagadda <kirankumark@marvell.com>
> Cc: Zhirun Yan <zhirun.yan@intel.com>; Cunming Liang
> <cunming.liang@intel.com>
> Subject: [EXT] [PATCH v2] graph: fix out of bounds access when re-allocate
> node objs
> 
> External Email
> 
> ----------------------------------------------------------------------
> For __rte_node_enqueue_prologue(), If the number of objs is more than the
> node->size * 2, the extra objs will write out of bounds memory.
> It should use __rte_node_stream_alloc_size() to request enough memory.
> 
> And for rte_node_next_stream_put(), it will re-allocate a small size, when the
> node free space is small and new objs is less than the current
> node->size. Some objs pointers behind new size may be lost. And it will
> cause memory leak. It should request enough size of memory, containing the
> original objs and new objs at least.
> 
> Fixes: 40d4f51403ec ("graph: implement fastpath routines")
> 
> Signed-off-by: Zhirun Yan <zhirun.yan@intel.com>
> Signed-off-by: Cunming Liang <cunming.liang@intel.com>


Acked-by: Jerin Jacob <jerinj@marvell.com>

> ---
>  lib/graph/rte_graph_worker.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/graph/rte_graph_worker.h b/lib/graph/rte_graph_worker.h index
> 0c0b9c095a..6dc7461659 100644
> --- a/lib/graph/rte_graph_worker.h
> +++ b/lib/graph/rte_graph_worker.h
> @@ -224,7 +224,7 @@ __rte_node_enqueue_prologue(struct rte_graph
> *graph, struct rte_node *node,
>  		__rte_node_enqueue_tail_update(graph, node);
> 
>  	if (unlikely(node->size < (idx + space)))
> -		__rte_node_stream_alloc(graph, node);
> +		__rte_node_stream_alloc_size(graph, node, node->size +
> space);
>  }
> 
>  /**
> @@ -432,7 +432,7 @@ rte_node_next_stream_get(struct rte_graph *graph,
> struct rte_node *node,
>  	uint16_t free_space = node->size - idx;
> 
>  	if (unlikely(free_space < nb_objs))
> -		__rte_node_stream_alloc_size(graph, node, nb_objs);
> +		__rte_node_stream_alloc_size(graph, node, node->size +
> nb_objs);
> 
>  	return &node->objs[idx];
>  }
> --
> 2.25.1
  

> > For __rte_node_enqueue_prologue(), If the number of objs is more than the
> > node->size * 2, the extra objs will write out of bounds memory.
> > It should use __rte_node_stream_alloc_size() to request enough memory.
> > 
> > And for rte_node_next_stream_put(), it will re-allocate a small size, when the
> > node free space is small and new objs is less than the current
> > node->size. Some objs pointers behind new size may be lost. And it will
> > cause memory leak. It should request enough size of memory, containing the
> > original objs and new objs at least.
> > 
> > Fixes: 40d4f51403ec ("graph: implement fastpath routines")
> > 
> > Signed-off-by: Zhirun Yan <zhirun.yan@intel.com>
> > Signed-off-by: Cunming Liang <cunming.liang@intel.com>
> 
> Acked-by: Jerin Jacob <jerinj@marvell.com>

Applied, thanks.