[dpdk-stable] patch 'bitmap: fix buffer overrun in bitmap init' has been queued to stable release 20.11.3

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 20.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/14/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/cd12bf5357831e4e9c196c2b624c382492f26db8

Thanks.

Luca Boccassi

---
>From cd12bf5357831e4e9c196c2b624c382492f26db8 Mon Sep 17 00:00:00 2001
From: Ivan Ilchenko <ivan.ilchenko at oktetlabs.ru>
Date: Wed, 2 Jun 2021 12:49:22 +0300
Subject: [PATCH] bitmap: fix buffer overrun in bitmap init

[ upstream commit 1ffd3bc1252ee871398dad227cd651658dc76939 ]

Bitmap initialization function is allowed to memset()
caller-provided buffer with number of bytes exceeded
this buffer size. This happens due to wrong comparison
sign between buffer size and number of bytes required
to initialize bitmap.

Fixes: 602c9ca33a4 ("sched: bitmap is now dynamically allocated")

Reported-by: Andy Moreton <amoreton at xilinx.com>
Signed-off-by: Ivan Ilchenko <ivan.ilchenko at oktetlabs.ru>
Reviewed-by: Andy Moreton <amoreton at xilinx.com>
Signed-off-by: Andrew Rybchenko <andrew.rybchenko at oktetlabs.ru>
Acked-by: Cristian Dumitrescu <cristian.dumitrescu at intel.com>
---
 lib/librte_eal/include/rte_bitmap.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/librte_eal/include/rte_bitmap.h b/lib/librte_eal/include/rte_bitmap.h
index 7c90ef333f..b38d9ac2ba 100644
--- a/lib/librte_eal/include/rte_bitmap.h
+++ b/lib/librte_eal/include/rte_bitmap.h
@@ -185,9 +185,8 @@ rte_bitmap_init(uint32_t n_bits, uint8_t *mem, uint32_t mem_size)
 	size = __rte_bitmap_get_memory_footprint(n_bits,
 		&array1_byte_offset, &array1_slabs,
 		&array2_byte_offset, &array2_slabs);
-	if (size < mem_size) {
+	if (size > mem_size)
 		return NULL;
-	}
 
 	/* Setup bitmap */
 	memset(mem, 0, size);
-- 
2.30.2

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-07-12 13:41:37.065884267 +0100
+++ 0003-bitmap-fix-buffer-overrun-in-bitmap-init.patch	2021-07-12 13:41:36.150115528 +0100
@@ -1 +1 @@
-From 1ffd3bc1252ee871398dad227cd651658dc76939 Mon Sep 17 00:00:00 2001
+From cd12bf5357831e4e9c196c2b624c382492f26db8 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1ffd3bc1252ee871398dad227cd651658dc76939 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
- lib/eal/include/rte_bitmap.h | 3 +--
+ lib/librte_eal/include/rte_bitmap.h | 3 +--
@@ -24,4 +25,4 @@
-diff --git a/lib/eal/include/rte_bitmap.h b/lib/eal/include/rte_bitmap.h
-index 9e2b8f2cbf..e4623bb176 100644
---- a/lib/eal/include/rte_bitmap.h
-+++ b/lib/eal/include/rte_bitmap.h
+diff --git a/lib/librte_eal/include/rte_bitmap.h b/lib/librte_eal/include/rte_bitmap.h
+index 7c90ef333f..b38d9ac2ba 100644
+--- a/lib/librte_eal/include/rte_bitmap.h
++++ b/lib/librte_eal/include/rte_bitmap.h