examples/ipsec-secgw: fix partial overflow
Checks
Commit Message
Case of partial overflow detected with ASan. Added extra padding
to cdev_key structure.
This structure is used for the key in hash table.
Padding is added to force the struct to use 8 bytes,
to ensure memory is notread past this structs boundary
(the hash key calculation reads 8 bytes if this struct is size 5 bytes).
The padding should be zeroed.
If fields are modified in this struct, the padding must be updated to
ensure multiple of 8 bytes size overall.
Fixes: d299106e8e31 ("examples/ipsec-secgw: add IPsec sample application")
Cc: sergio.gonzalez.monroy@intel.com
Cc: stable@dpdk.org
Signed-off-by: Brian Dooley <brian.dooley@intel.com>
---
examples/ipsec-secgw/ipsec.h | 10 ++++++++++
1 file changed, 10 insertions(+)
Comments
> -----Original Message-----
> From: Brian Dooley <brian.dooley@intel.com>
> Sent: Wednesday, November 15, 2023 12:31 PM
> To: dev@dpdk.org
> Cc: Dooley, Brian <brian.dooley@intel.com>;
> sergio.gonzalez.monroy@intel.com; stable@dpdk.org; Nicolau, Radu
> <radu.nicolau@intel.com>; Akhil Goyal <gakhil@marvell.com>
> Subject: [PATCH] examples/ipsec-secgw: fix partial overflow
>
> Case of partial overflow detected with ASan. Added extra padding to cdev_key
> structure.
>
> This structure is used for the key in hash table.
> Padding is added to force the struct to use 8 bytes, to ensure memory is
> notread past this structs boundary (the hash key calculation reads 8 bytes if
> this struct is size 5 bytes).
> The padding should be zeroed.
> If fields are modified in this struct, the padding must be updated to ensure
> multiple of 8 bytes size overall.
>
> Fixes: d299106e8e31 ("examples/ipsec-secgw: add IPsec sample application")
> Cc: sergio.gonzalez.monroy@intel.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Brian Dooley <brian.dooley@intel.com>
Acked-by: Ciara Power <ciara.power@intel.com>
> > Case of partial overflow detected with ASan. Added extra padding to cdev_key
> > structure.
> >
> > This structure is used for the key in hash table.
> > Padding is added to force the struct to use 8 bytes, to ensure memory is
> > notread past this structs boundary (the hash key calculation reads 8 bytes if
> > this struct is size 5 bytes).
> > The padding should be zeroed.
> > If fields are modified in this struct, the padding must be updated to ensure
> > multiple of 8 bytes size overall.
> >
> > Fixes: d299106e8e31 ("examples/ipsec-secgw: add IPsec sample application")
> > Cc: sergio.gonzalez.monroy@intel.com
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Brian Dooley <brian.dooley@intel.com>
>
> Acked-by: Ciara Power <ciara.power@intel.com>
Applied and made the comment simpler with this:
uint8_t padding[3]; /* padding to 8-byte size should be zeroed */
Thanks Thomas, makes sense.
> -----Original Message-----
> From: Thomas Monjalon <thomas@monjalon.net>
> Sent: Wednesday, November 22, 2023 4:38 PM
> To: Dooley, Brian <brian.dooley@intel.com>
> Cc: dev@dpdk.org; stable@dpdk.org; Nicolau, Radu
> <radu.nicolau@intel.com>; Akhil Goyal <gakhil@marvell.com>; Power, Ciara
> <ciara.power@intel.com>
> Subject: Re: [PATCH] examples/ipsec-secgw: fix partial overflow
>
> > > Case of partial overflow detected with ASan. Added extra padding to
> > > cdev_key structure.
> > >
> > > This structure is used for the key in hash table.
> > > Padding is added to force the struct to use 8 bytes, to ensure
> > > memory is notread past this structs boundary (the hash key
> > > calculation reads 8 bytes if this struct is size 5 bytes).
> > > The padding should be zeroed.
> > > If fields are modified in this struct, the padding must be updated
> > > to ensure multiple of 8 bytes size overall.
> > >
> > > Fixes: d299106e8e31 ("examples/ipsec-secgw: add IPsec sample
> > > application")
> > > Cc: sergio.gonzalez.monroy@intel.com
> > > Cc: stable@dpdk.org
> > >
> > > Signed-off-by: Brian Dooley <brian.dooley@intel.com>
> >
> > Acked-by: Ciara Power <ciara.power@intel.com>
>
> Applied and made the comment simpler with this:
>
> uint8_t padding[3]; /* padding to 8-byte size should be zeroed */
>
>
@@ -249,11 +249,21 @@ struct offloads {
extern struct offloads tx_offloads;
+/*
+ * This structure is used for the key in hash table.
+ * Padding is added to force the struct to use 8 bytes,
+ * to ensure memory is notread past this structs boundary
+ * (the hash key calculation reads 8 bytes if this struct is size 5 bytes).
+ * The padding should be zeroed.
+ * If fields are modified in this struct, the padding must be updated to
+ * ensure multiple of 8 bytes size overall.
+ */
struct cdev_key {
uint16_t lcore_id;
uint8_t cipher_algo;
uint8_t auth_algo;
uint8_t aead_algo;
+ uint8_t padding[3];
};
struct socket_ctx {