From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yipeng Wang Subject: [PATCH v4 1/4] hash: fix race condition in iterate Date: Fri, 28 Sep 2018 10:23:43 -0700 Message-ID: <1538155426-145177-2-git-send-email-yipeng1.wang@intel.com> References: <1537993618-92630-1-git-send-email-yipeng1.wang@intel.com> <1538155426-145177-1-git-send-email-yipeng1.wang@intel.com> Cc: konstantin.ananyev@intel.com, dev@dpdk.org, yipeng1.wang@intel.com, honnappa.nagarahalli@arm.com, sameh.gobriel@intel.com To: bruce.richardson@intel.com Return-path: Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by dpdk.org (Postfix) with ESMTP id 2D1E35F19 for ; Sat, 29 Sep 2018 02:28:51 +0200 (CEST) In-Reply-To: <1538155426-145177-1-git-send-email-yipeng1.wang@intel.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In rte_hash_iterate, the reader lock did not protect the while loop which checks empty entry. This created a race condition that the entry may become empty when enters the lock, then a wrong key data value would be read out. This commit extends the protected region. Fixes: f2e3001b53ec ("hash: support read/write concurrency") Cc: stable@dpdk.org Signed-off-by: Yipeng Wang Reported-by: Honnappa Nagarahalli --- lib/librte_hash/rte_cuckoo_hash.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/librte_hash/rte_cuckoo_hash.c b/lib/librte_hash/rte_cuckoo_hash.c index f7b86c8..eba13e9 100644 --- a/lib/librte_hash/rte_cuckoo_hash.c +++ b/lib/librte_hash/rte_cuckoo_hash.c @@ -1317,16 +1317,19 @@ rte_hash_iterate(const struct rte_hash *h, const void **key, void **data, uint32 bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES; idx = *next % RTE_HASH_BUCKET_ENTRIES; + __hash_rw_reader_lock(h); /* If current position is empty, go to the next one */ while (h->buckets[bucket_idx].key_idx[idx] == EMPTY_SLOT) { (*next)++; /* End of table */ - if (*next == total_entries) + if (*next == total_entries) { + __hash_rw_reader_unlock(h); return -ENOENT; + } bucket_idx = *next / RTE_HASH_BUCKET_ENTRIES; idx = *next % RTE_HASH_BUCKET_ENTRIES; } - __hash_rw_reader_lock(h); + /* Get position of entry in key table */ position = h->buckets[bucket_idx].key_idx[idx]; next_key = (struct rte_hash_key *) ((char *)h->key_store + -- 2.7.4