diff mbox

[dpdk-dev] mempool: fix corruption due to invalid handler

Message ID 1473348597-11904-1-git-send-email-droidluo@gmail.com (mailing list archive)
State Accepted, archived
Delegated to: Thomas Monjalon
Headers

Commit Message

Weiliang Luo Sept. 8, 2016, 3:29 p.m. UTC 
  When using rte_mempool_create(), the mempool handler is selected
depending on the flags given by the user:
  - multi-consumer / multi-producer
  - multi-consumer / single-producer
  - single-consumer / multi-producer
  - single-consumer / single-producer

The flags were not properly tested, resulting in the selection of sc/sp
handler if sc/mp or mc/sp was asked. This can lead to corruption or
crashes because the get/put operations are not atomic.

Fixes: 449c49b93a6b ("mempool: support handler operations")

Signed-off-by: Weiliang Luo <droidluo@gmail.com>
Acked-by: Olivier Matz <olivier.matz@6wind.com>
---
 lib/librte_mempool/rte_mempool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Thomas Monjalon Sept. 16, 2016, 2:19 p.m. UTC | #1 
CC stable@dpdk.org

2016-09-08 10:29, Weiliang Luo:
> When using rte_mempool_create(), the mempool handler is selected
> depending on the flags given by the user:
>   - multi-consumer / multi-producer
>   - multi-consumer / single-producer
>   - single-consumer / multi-producer
>   - single-consumer / single-producer
> 
> The flags were not properly tested, resulting in the selection of sc/sp
> handler if sc/mp or mc/sp was asked. This can lead to corruption or
> crashes because the get/put operations are not atomic.
> 
> Fixes: 449c49b93a6b ("mempool: support handler operations")
> 
> Signed-off-by: Weiliang Luo <droidluo@gmail.com>
> Acked-by: Olivier Matz <olivier.matz@6wind.com>

Applied, thanks
diff mbox

Patch

diff --git a/lib/librte_mempool/rte_mempool.c b/lib/librte_mempool/rte_mempool.c
index 2e28e2e..350d77a 100644
--- a/lib/librte_mempool/rte_mempool.c
+++ b/lib/librte_mempool/rte_mempool.c
@@ -879,7 +879,7 @@  rte_mempool_create(const char *name, unsigned n, unsigned elt_size,
 	 * Since we have 4 combinations of the SP/SC/MP/MC examine the flags to
 	 * set the correct index into the table of ops structs.
 	 */
-	if (flags & (MEMPOOL_F_SP_PUT | MEMPOOL_F_SC_GET))
+	if ((flags & MEMPOOL_F_SP_PUT) && (flags & MEMPOOL_F_SC_GET))
 		rte_mempool_set_ops_byname(mp, "ring_sp_sc", NULL);
 	else if (flags & MEMPOOL_F_SP_PUT)
 		rte_mempool_set_ops_byname(mp, "ring_sp_mc", NULL);