From 1ffd3bc1252ee871398dad227cd651658dc76939 Mon Sep 17 00:00:00 2001 From: Ivan Ilchenko Date: Wed, 2 Jun 2021 12:49:22 +0300 Subject: [PATCH] bitmap: fix buffer overrun in bitmap init Bitmap initialization function is allowed to memset() caller-provided buffer with number of bytes exceeded this buffer size. This happens due to wrong comparison sign between buffer size and number of bytes required to initialize bitmap. Fixes: 602c9ca33a4 ("sched: bitmap is now dynamically allocated") Cc: stable@dpdk.org Reported-by: Andy Moreton Signed-off-by: Ivan Ilchenko Reviewed-by: Andy Moreton Signed-off-by: Andrew Rybchenko Acked-by: Cristian Dumitrescu --- lib/eal/include/rte_bitmap.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/eal/include/rte_bitmap.h b/lib/eal/include/rte_bitmap.h index 9e2b8f2cbfa..e4623bb176e 100644 --- a/lib/eal/include/rte_bitmap.h +++ b/lib/eal/include/rte_bitmap.h @@ -185,9 +185,8 @@ rte_bitmap_init(uint32_t n_bits, uint8_t *mem, uint32_t mem_size) size = __rte_bitmap_get_memory_footprint(n_bits, &array1_byte_offset, &array1_slabs, &array2_byte_offset, &array2_slabs); - if (size < mem_size) { + if (size > mem_size) return NULL; - } /* Setup bitmap */ memset(mem, 0, size);