From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ilya Matveychikov Subject: [PATCH 1/2] mbuf: check sanity of data_len and pkt_len as well Date: Thu, 16 Nov 2017 18:04:43 +0400 Message-ID: Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable To: dev@dpdk.org Return-path: Received: from mail-wm0-f68.google.com (mail-wm0-f68.google.com [74.125.82.68]) by dpdk.org (Postfix) with ESMTP id D3034237 for ; Thu, 16 Nov 2017 15:04:43 +0100 (CET) Received: by mail-wm0-f68.google.com with SMTP id v186so195995wma.2 for ; Thu, 16 Nov 2017 06:04:43 -0800 (PST) Received: from [10.61.0.167] (bba193485.alshamil.net.ae. [217.165.96.191]) by smtp.gmail.com with ESMTPSA id p91sm1114874edp.69.2017.11.16.06.04.42 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Nov 2017 06:04:42 -0800 (PST) List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Signed-off-by: Ilya V. Matveychikov --- lib/librte_mbuf/rte_mbuf.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c index 7543662f7..491685c36 100644 --- a/lib/librte_mbuf/rte_mbuf.c +++ b/lib/librte_mbuf/rte_mbuf.c @@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned = n, void rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header) { - const struct rte_mbuf *m_seg; - unsigned int nb_segs; + unsigned int nb_segs, pkt_len; if (m =3D=3D NULL) rte_panic("mbuf is NULL\n"); @@ -220,18 +219,26 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, = int is_header) if ((cnt =3D=3D 0) || (cnt =3D=3D UINT16_MAX)) rte_panic("bad ref cnt\n"); + /* data_len supposed to be not more than pkt_len */ + if (m->data_len > m->pkt_len) + rte_panic("bad data_len\n"); + /* nothing to check for sub-segments */ if (is_header =3D=3D 0) return; nb_segs =3D m->nb_segs; - m_seg =3D m; - while (m_seg && nb_segs !=3D 0) { - m_seg =3D m_seg->next; - nb_segs--; - } - if (nb_segs !=3D 0) + pkt_len =3D m->pkt_len; + + do { + nb_segs -=3D 1; + pkt_len -=3D m->data_len; + } while ((m =3D m->next) !=3D NULL); + + if (nb_segs) rte_panic("bad nb_segs\n"); + if (pkt_len) + rte_panic("bad pkt_len\n"); } /* dump a mbuf on console */ -- 2.15.0=