From: Robert Sanford <rsanford2@gmail.com>
To: dev@dpdk.org
Cc: vladimir.medvedkin@intel.com,
Robert Sanford <rsanford@akamai.com>,
stable@dpdk.org
Subject: [PATCH v2 1/5] rib: fix undefined behavior in bit test
Date: Tue, 27 Oct 2026 10:54:01 -0400 [thread overview]
Message-ID: <20261027145405.3454251-2-rsanford2@gmail.com> (raw)
In-Reply-To: <20261027145405.3454251-1-rsanford2@gmail.com>
From: Robert Sanford <rsanford@akamai.com>
The tree walk in rte_rib.c tests the bit below a node's depth with
1 << (31 - depth). For a node at depth 0, which exists for a default
route or for a common parent of routes in both halves of the address
space, that is 1 << 31 on a signed int, which is undefined behavior.
UBSan reports:
rte_rib.c:82:18: runtime error: left shift of 1 by 31 places
cannot be represented in type 'int'
and the same at lines 311 and 343. No existing unit test adds a
depth-0 route, so this was not caught before. The new test/fib
wraparound test in this series does.
Use an unsigned constant in all four bit tests. The shift count is
between 0 and 31 at each of them.
Fixes: 5a5793a5ffa2 ("rib: add RIB library")
Cc: stable@dpdk.org
Signed-off-by: Robert Sanford <rsanford@akamai.com>
---
v2: new patch in this series.
lib/rib/rte_rib.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lib/rib/rte_rib.c b/lib/rib/rte_rib.c
index 046db131ca..43d5ab1498 100644
--- a/lib/rib/rte_rib.c
+++ b/lib/rib/rte_rib.c
@@ -79,7 +79,7 @@ get_nxt_node(struct rte_rib_node *node, uint32_t ip)
{
if (node->depth == RIB_MAXDEPTH)
return NULL;
- return (ip & (1 << (31 - node->depth))) ? node->right : node->left;
+ return (ip & (1U << (31 - node->depth))) ? node->right : node->left;
}
static struct rte_rib_node *
@@ -308,7 +308,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
if ((d >= depth) || !is_covered(ip, (*tmp)->ip, d))
break;
prev = *tmp;
- tmp = (ip & (1 << (31 - d))) ? &(*tmp)->right : &(*tmp)->left;
+ tmp = (ip & (1U << (31 - d))) ? &(*tmp)->right : &(*tmp)->left;
}
/* closest node found, new_node should be inserted in the middle */
common_depth = RTE_MIN(depth, (*tmp)->depth);
@@ -319,7 +319,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
common_prefix = ip & rte_rib_depth_to_mask(common_depth);
if ((common_prefix == ip) && (common_depth == depth)) {
/* insert as a parent */
- if ((*tmp)->ip & (1 << (31 - depth)))
+ if ((*tmp)->ip & (1U << (31 - depth)))
new_node->right = *tmp;
else
new_node->left = *tmp;
@@ -340,7 +340,7 @@ rte_rib_insert(struct rte_rib *rib, uint32_t ip, uint8_t depth)
common_node->parent = (*tmp)->parent;
new_node->parent = common_node;
(*tmp)->parent = common_node;
- if ((new_node->ip & (1 << (31 - common_depth))) == 0) {
+ if ((new_node->ip & (1U << (31 - common_depth))) == 0) {
common_node->left = new_node;
common_node->right = *tmp;
} else {
--
2.34.1
next prev parent reply other threads:[~2026-10-27 14:54 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 0:14 [PATCH v1 0/4] fib: fix full table overwrite on address wraparound Robert Sanford
2026-10-27 0:14 ` [PATCH v1 1/4] " Robert Sanford
2026-10-27 0:14 ` [PATCH v1 2/4] fib6: " Robert Sanford
2026-10-27 0:14 ` [PATCH v1 3/4] test/fib: reproduce " Robert Sanford
2026-10-27 0:14 ` [PATCH v1 4/4] test/fib6: " Robert Sanford
2026-10-27 14:54 ` [PATCH v2 0/5] fib: fix full " Robert Sanford
2026-10-27 14:54 ` Robert Sanford [this message]
2026-10-27 14:54 ` [PATCH v2 2/5] " Robert Sanford
2026-10-27 14:54 ` [PATCH v2 3/5] fib6: " Robert Sanford
2026-10-27 14:54 ` [PATCH v2 4/5] test/fib: reproduce " Robert Sanford
2026-10-27 14:54 ` [PATCH v2 5/5] test/fib6: " Robert Sanford
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027145405.3454251-2-rsanford2@gmail.com \
--to=rsanford2@gmail.com \
--cc=dev@dpdk.org \
--cc=rsanford@akamai.com \
--cc=stable@dpdk.org \
--cc=vladimir.medvedkin@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox