> -----Original Message-----
> From: Zhirun Yan <zhirun....@intel.com>
> Sent: Thursday, August 4, 2022 11:33 AM
> To: dev@dpdk.org; Jerin Jacob Kollanukkaran <jer...@marvell.com>; Kiran
> Kumar Kokkilagadda <kirankum...@marvell.com>
> Cc: Zhirun Yan <zhirun....@intel.com>; Cunming Liang
> <cunming.li...@intel.com>
> Subject: [EXT] [PATCH v2] graph: fix out of bounds access when re-allocate
> node objs
>
> External Email
>
> ----------------------------------------------------------------------
> For __rte_node_enqueue_prologue(), If the number of objs is more than the
> node->size * 2, the extra objs will write out of bounds memory.
> It should use __rte_node_stream_alloc_size() to request enough memory.
>
> And for rte_node_next_stream_put(), it will re-allocate a small size, when the
> node free space is small and new objs is less than the current
> node->size. Some objs pointers behind new size may be lost. And it will
> cause memory leak. It should request enough size of memory, containing the
> original objs and new objs at least.
>
> Fixes: 40d4f51403ec ("graph: implement fastpath routines")
>
> Signed-off-by: Zhirun Yan <zhirun....@intel.com>
> Signed-off-by: Cunming Liang <cunming.li...@intel.com>
Acked-by: Jerin Jacob <jer...@marvell.com>
> ---
> lib/graph/rte_graph_worker.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lib/graph/rte_graph_worker.h b/lib/graph/rte_graph_worker.h index
> 0c0b9c095a..6dc7461659 100644
> --- a/lib/graph/rte_graph_worker.h
> +++ b/lib/graph/rte_graph_worker.h
> @@ -224,7 +224,7 @@ __rte_node_enqueue_prologue(struct rte_graph
> *graph, struct rte_node *node,
> __rte_node_enqueue_tail_update(graph, node);
>
> if (unlikely(node->size < (idx + space)))
> - __rte_node_stream_alloc(graph, node);
> + __rte_node_stream_alloc_size(graph, node, node->size +
> space);
> }
>
> /**
> @@ -432,7 +432,7 @@ rte_node_next_stream_get(struct rte_graph *graph,
> struct rte_node *node,
> uint16_t free_space = node->size - idx;
>
> if (unlikely(free_space < nb_objs))
> - __rte_node_stream_alloc_size(graph, node, nb_objs);
> + __rte_node_stream_alloc_size(graph, node, node->size +
> nb_objs);
>
> return &node->objs[idx];
> }
> --
> 2.25.1
