malloc_heap: Possible Control Block Overwrite When Insufficient Space in Elem

[wuchangsheng (C)]

Hello,

I seem to have discovered a problem in the heap memory allocation and deallocation operations.

    |------------------|----------------------------|

  elem  padsize    newelem

In the malloc_elem_alloc function, when padsize > cache-line (such as 64 bytes) and padsize < sizeof(struct malloc_elem), the initialization of new_elem will overwrite and damage the struct malloc_elem information of elem, while setting the state of new_elem to ELEM_PAD. When releasing new_elem in malloc_elem_free, it will be converted to elem using RTE_PTR_SUB(new_elem, new_elem->pad), but at this point, the struct malloc_elem information of elem is damaged.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/dev/attachments/20230330/3c19ef16/attachment.htm>