DPDK-dev Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Robert Sanford <rsanford2@gmail.com>
To: dev@dpdk.org
Cc: vladimir.medvedkin@intel.com,
	Robert Sanford <rsanford@akamai.com>,
	stable@dpdk.org
Subject: [PATCH v2 1/5] rib: fix undefined behavior in bit test
Date: Tue, 27 Oct 2026 10:54:01 -0400	[thread overview]
Message-ID: <20261027145405.3454251-2-rsanford2@gmail.com> (raw)
In-Reply-To: <20261027145405.3454251-1-rsanford2@gmail.com>

From: Robert Sanford <rsanford@akamai.com>

The tree walk in rte_rib.c tests the bit below a node's depth with
1 << (31 - depth). For a node at depth 0, which exists for a default
route or for a common parent of routes in both halves of the address
space, that is 1 << 31 on a signed int, which is undefined behavior.
UBSan reports:

  rte_rib.c:82:18: runtime error: left shift of 1 by 31 places
  cannot be represented in type 'int'

and the same at lines 311 and 343. No existing unit test adds a
depth-0 route, so this was not caught before. The new test/fib
wraparound test in this series does.

Use an unsigned constant in all four bit tests. The shift count is
between 0 and 31 at each of them.

Fixes: 5a5793a5ffa2 ("rib: add RIB library")
Cc: stable@dpdk.org

Signed-off-by: Robert Sanford <rsanford@akamai.com>
---
v2: new patch in this series.

 lib/rib/rte_rib.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/rib/rte_rib.c b/lib/rib/rte_rib.c
index 046db131ca..43d5ab1498 100644
--- a/lib/rib/rte_rib.c
+++ b/lib/rib/rte_rib.c
@@ -79,7 +79,7 @@ get_nxt_node(struct rte_rib_node *node, uint32_t ip)
 {
 	if (node->depth == RIB_MAXDEPTH)
 		return NULL;
-	return (ip & (1 << (31 - node->depth))) ? node->right : node->left;
+	return (ip & (1U << (31 - node->depth))) ? node->right : node->left;
 }
 
 static struct rte_rib_node *
@@ -308,7 +308,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
 		if ((d >= depth) || !is_covered(ip, (*tmp)->ip, d))
 			break;
 		prev = *tmp;
-		tmp = (ip & (1 << (31 - d))) ? &(*tmp)->right : &(*tmp)->left;
+		tmp = (ip & (1U << (31 - d))) ? &(*tmp)->right : &(*tmp)->left;
 	}
 	/* closest node found, new_node should be inserted in the middle */
 	common_depth = RTE_MIN(depth, (*tmp)->depth);
@@ -319,7 +319,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
 	common_prefix = ip & rte_rib_depth_to_mask(common_depth);
 	if ((common_prefix == ip) && (common_depth == depth)) {
 		/* insert as a parent */
-		if ((*tmp)->ip & (1 << (31 - depth)))
+		if ((*tmp)->ip & (1U << (31 - depth)))
 			new_node->right = *tmp;
 		else
 			new_node->left = *tmp;
@@ -340,7 +340,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
 		common_node->parent = (*tmp)->parent;
 		new_node->parent = common_node;
 		(*tmp)->parent = common_node;
-		if ((new_node->ip & (1 << (31 - common_depth))) == 0) {
+		if ((new_node->ip & (1U << (31 - common_depth))) == 0) {
 			common_node->left = new_node;
 			common_node->right = *tmp;
 		} else {
-- 
2.34.1


  reply	other threads:[~2026-10-27 14:54 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27  0:14 [PATCH v1 0/4] fib: fix full table overwrite on address wraparound Robert Sanford
2026-10-27  0:14 ` [PATCH v1 1/4] " Robert Sanford
2026-10-27  0:14 ` [PATCH v1 2/4] fib6: " Robert Sanford
2026-10-27  0:14 ` [PATCH v1 3/4] test/fib: reproduce " Robert Sanford
2026-10-27  0:14 ` [PATCH v1 4/4] test/fib6: " Robert Sanford
2026-10-27 14:54 ` [PATCH v2 0/5] fib: fix full " Robert Sanford
2026-10-27 14:54   ` Robert Sanford [this message]
2026-10-27 14:54   ` [PATCH v2 2/5] " Robert Sanford
2026-10-27 14:54   ` [PATCH v2 3/5] fib6: " Robert Sanford
2026-10-27 14:54   ` [PATCH v2 4/5] test/fib: reproduce " Robert Sanford
2026-10-27 14:54   ` [PATCH v2 5/5] test/fib6: " Robert Sanford

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261027145405.3454251-2-rsanford2@gmail.com \
    --to=rsanford2@gmail.com \
    --cc=dev@dpdk.org \
    --cc=rsanford@akamai.com \
    --cc=stable@dpdk.org \
    --cc=vladimir.medvedkin@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox