From: Ivan Ilchenko <ivan.ilche...@oktetlabs.ru> Bitmap initialization function is allowed to memset() caller-provided buffer with number of bytes exceeded this buffer size. This happens due to wrong comparison sign between buffer size and number of bytes required to initialize bitmap.
Fixes: 602c9ca33a4 ("sched: bitmap is now dynamically allocated") Cc: sta...@dpdk.org Reported-by: Andy Moreton <amore...@xilinx.com> Signed-off-by: Ivan Ilchenko <ivan.ilche...@oktetlabs.ru> Reviewed-by: Andy Moreton <amore...@xilinx.com> Signed-off-by: Andrew Rybchenko <andrew.rybche...@oktetlabs.ru> --- lib/eal/include/rte_bitmap.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/eal/include/rte_bitmap.h b/lib/eal/include/rte_bitmap.h index 9e2b8f2cbf..e4623bb176 100644 --- a/lib/eal/include/rte_bitmap.h +++ b/lib/eal/include/rte_bitmap.h @@ -185,9 +185,8 @@ rte_bitmap_init(uint32_t n_bits, uint8_t *mem, uint32_t mem_size) size = __rte_bitmap_get_memory_footprint(n_bits, &array1_byte_offset, &array1_slabs, &array2_byte_offset, &array2_slabs); - if (size < mem_size) { + if (size > mem_size) return NULL; - } /* Setup bitmap */ memset(mem, 0, size); -- 2.30.2