From mboxrd@z Thu Jan  1 00:00:00 1970
From: Olivier MATZ <olivier.matz@6wind.com>
Subject: Re: [PATCH 1/2] mbuf: check sanity of data_len and
 pkt_len as well
Date: Fri, 1 Dec 2017 17:37:55 +0100
Message-ID: <20171201163754.zhsd2uieqfhi6y7v@platinum>
References: <DEC79BD0-6A0F-453F-9E7E-0C7E3C9234BB@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: dev@dpdk.org
To: Ilya Matveychikov <matvejchikov@gmail.com>
Return-path: <dev-bounces@dpdk.org>
Received: from mail.droids-corp.org (zoll.droids-corp.org [94.23.50.67])
 by dpdk.org (Postfix) with ESMTP id 5CDE02C3F
 for <dev@dpdk.org>; Fri,  1 Dec 2017 17:38:02 +0100 (CET)
Content-Disposition: inline
In-Reply-To: <DEC79BD0-6A0F-453F-9E7E-0C7E3C9234BB@gmail.com>
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <http://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <http://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

Hi Ilya,

On Thu, Nov 16, 2017 at 06:04:43PM +0400, Ilya Matveychikov wrote:
> Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>

Please, add a commit log.

> ---
>  lib/librte_mbuf/rte_mbuf.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)
> 
> diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
> index 7543662f7..491685c36 100644
> --- a/lib/librte_mbuf/rte_mbuf.c
> +++ b/lib/librte_mbuf/rte_mbuf.c
> @@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned n,
>  void
>  rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
>  {
> -	const struct rte_mbuf *m_seg;
> -	unsigned int nb_segs;
> +	unsigned int nb_segs, pkt_len;
> 
>  	if (m == NULL)
>  		rte_panic("mbuf is NULL\n");
> @@ -220,18 +219,26 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
>  	if ((cnt == 0) || (cnt == UINT16_MAX))
>  		rte_panic("bad ref cnt\n");
> 
> +	/* data_len supposed to be not more than pkt_len */
> +	if (m->data_len > m->pkt_len)
> +		rte_panic("bad data_len\n");
> +

This check should only be done if is_header == 1.