From: Bulatov Mark <ms.bulatov7@gmail.com>
To: Cristian Dumitrescu <cristian.dumitrescu@intel.com>
Cc: dev@dpdk.org, stable@dpdk.org, Mark Bulatov <ms.bulatov7@gmail.com>
Subject: [PATCH 25.11] table: fix no cast overflow
Date: Fri, 13 Nov 2026 17:34:29 +0300 [thread overview]
Message-ID: <20261113143429.6366-1-ms.bulatov7@gmail.com> (raw)
From: Mark Bulatov <ms.bulatov7@gmail.com>
The sum p->n_buckets + n_buckets_ext fits within the bounds of a uint32_t.
However, multiplying this result by bucket_size causes an overflow.
Fix this by using type casting.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: fc972a1305 ("table: rework 16-byte key hash tables")
Fixes: ea31510376 ("table: rework 32-byte key hash tables")
Fixes: 36842d0aee ("table: rework 8-byte key hash tables")
Cc: stable@dpdk.org
Signed-off-by: Mark Bulatov <ms.bulatov7@gmail.com>
---
lib/table/rte_table_hash_key16.c | 2 +-
lib/table/rte_table_hash_key32.c | 2 +-
lib/table/rte_table_hash_key8.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/table/rte_table_hash_key16.c b/lib/table/rte_table_hash_key16.c
index 5b69106dd7..99ccf3f549 100644
--- a/lib/table/rte_table_hash_key16.c
+++ b/lib/table/rte_table_hash_key16.c
@@ -394,7 +394,7 @@ rte_table_hash_create_key16_ext(void *params,
KEYS_PER_BUCKET * entry_size);
stack_size = RTE_CACHE_LINE_ROUNDUP(n_buckets_ext * sizeof(uint32_t));
total_size = sizeof(struct rte_table_hash) +
- (p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
+ (uint64_t)(p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
if (total_size > SIZE_MAX) {
TABLE_LOG(ERR, "%s: Cannot allocate %" PRIu64 " bytes "
"for hash table %s",
diff --git a/lib/table/rte_table_hash_key32.c b/lib/table/rte_table_hash_key32.c
index 0963f57828..1b359bbeb8 100644
--- a/lib/table/rte_table_hash_key32.c
+++ b/lib/table/rte_table_hash_key32.c
@@ -403,7 +403,7 @@ rte_table_hash_create_key32_ext(void *params,
KEYS_PER_BUCKET * entry_size);
stack_size = RTE_CACHE_LINE_ROUNDUP(n_buckets_ext * sizeof(uint32_t));
total_size = sizeof(struct rte_table_hash) +
- (p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
+ (uint64_t)(p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
if (total_size > SIZE_MAX) {
TABLE_LOG(ERR, "%s: Cannot allocate %" PRIu64 " bytes "
"for hash table %s",
diff --git a/lib/table/rte_table_hash_key8.c b/lib/table/rte_table_hash_key8.c
index 5e9dcf10ee..8fd80edafc 100644
--- a/lib/table/rte_table_hash_key8.c
+++ b/lib/table/rte_table_hash_key8.c
@@ -379,7 +379,7 @@ rte_table_hash_create_key8_ext(void *params, int socket_id, uint32_t entry_size)
KEYS_PER_BUCKET * entry_size);
stack_size = RTE_CACHE_LINE_ROUNDUP(n_buckets_ext * sizeof(uint32_t));
total_size = sizeof(struct rte_table_hash) +
- (p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
+ (uint64_t)(p->n_buckets + n_buckets_ext) * bucket_size + stack_size;
if (total_size > SIZE_MAX) {
TABLE_LOG(ERR, "%s: Cannot allocate %" PRIu64 " bytes "
--
2.39.5
reply other threads:[~2026-11-13 16:07 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261113143429.6366-1-ms.bulatov7@gmail.com \
--to=ms.bulatov7@gmail.com \
--cc=cristian.dumitrescu@intel.com \
--cc=dev@dpdk.org \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox