From: Robert Sanford <[email protected]>
In build_common_root(), get_idx() returns a uint32_t, but the result
was stored in an int. When the high bit was set, the value became
negative and was then sign-extended when passed as the uint64_t index
to get_tbl_p_by_idx(), producing a bogus table pointer.
Make idx and prev_idx unsigned, and use a separate signed tbl8_idx for
the tbl8_alloc() result, since it returns a negative value on error.
Widen to 64 bits before shifting or multiplying so the intermediate
results cannot overflow.
Fixes: c3e12e0f03 ("fib: add dataplane algorithm for IPv6")
Cc: [email protected]
Signed-off-by: Robert Sanford <[email protected]>
---
lib/fib/trie.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/lib/fib/trie.c b/lib/fib/trie.c
index 187360d1c8..dc57127dc9 100644
--- a/lib/fib/trie.c
+++ b/lib/fib/trie.c
@@ -317,7 +317,8 @@ build_common_root(struct rte_trie_tbl *dp, const struct
rte_ipv6_addr *ip,
void *tbl_ptr = NULL;
uint64_t *cur_tbl;
uint64_t val;
- int i, j, idx, prev_idx = 0;
+ uint32_t idx, prev_idx = 0;
+ int i, j, tbl8_idx;
cur_tbl = dp->tbl24;
for (i = 3, j = 0; i <= common_bytes; i++) {
@@ -325,20 +326,20 @@ build_common_root(struct rte_trie_tbl *dp, const struct
rte_ipv6_addr *ip,
val = get_tbl_val_by_idx(cur_tbl, idx, dp->nh_sz);
tbl_ptr = get_tbl_p_by_idx(cur_tbl, idx, dp->nh_sz);
if ((val & TRIE_EXT_ENT) != TRIE_EXT_ENT) {
- idx = tbl8_alloc(dp, val);
- if (unlikely(idx < 0))
- return idx;
- write_to_dp(tbl_ptr, (idx << 1) |
+ tbl8_idx = tbl8_alloc(dp, val);
+ if (unlikely(tbl8_idx < 0))
+ return tbl8_idx;
+ write_to_dp(tbl_ptr, ((uint64_t)tbl8_idx << 1) |
TRIE_EXT_ENT, dp->nh_sz, 1);
- prev_idx = idx;
+ prev_idx = tbl8_idx;
} else
prev_idx = val >> 1;
j = i;
cur_tbl = dp->tbl8;
}
- *tbl = get_tbl_p_by_idx(cur_tbl, prev_idx * TRIE_TBL8_GRP_NUM_ENT,
- dp->nh_sz);
+ *tbl = get_tbl_p_by_idx(cur_tbl,
+ (uint64_t)prev_idx * TRIE_TBL8_GRP_NUM_ENT, dp->nh_sz);
return 0;
}
--
2.34.1
