From: Vladislav Grishenko <themiron@yandex-team.ru>
Date: Sat, 13 Mar 2021 15:48:35 +0000 (+0500)
Subject: svm: fix svm queue overwrite while adding 2 elements
X-Git-Tag: v24.10-rc0~198
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=eb5a08e91d3d7d0f9fc97aeedcbcc02b7a8b753a;p=vpp.git

svm: fix svm queue overwrite while adding 2 elements

Adding two elements to the full svm queue passes exact
bounds check, therefore tail gets overwritten w/o any
waiting. Fix it with requiring at lease two free slots.

Type: fix
Signed-off-by: Vladislav Grishenko <themiron@yandex-team.ru>
Change-Id: I704ee606c47b523952cb965f848339ae1988cb60
---

diff --git a/src/svm/queue.c b/src/svm/queue.c
index 864d97e3de4..78444d8ede4 100644
--- a/src/svm/queue.c
+++ b/src/svm/queue.c
@@ -323,14 +323,14 @@ svm_queue_add2 (svm_queue_t * q, u8 * elem, u8 * elem2, int nowait)
   else
     svm_queue_lock (q);
 
-  if (PREDICT_FALSE (q->cursize + 1 == q->maxsize))
+  if (PREDICT_FALSE (q->cursize + 1 >= q->maxsize))
     {
       if (nowait)
 	{
 	  svm_queue_unlock (q);
 	  return (-2);
 	}
-      while (q->cursize + 1 == q->maxsize)
+      while (q->cursize + 1 >= q->maxsize)
 	svm_queue_wait_inline (q);
     }