This patch checks the packet length offset value, and checks if the
extra bytes inside buffer cross page boundary.
Signed-off-by: Changchun Ouyang <changchun.ouyang@intel.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
}
if (vm2vm_mode == VM2VM_HARDWARE) {
}
if (vm2vm_mode == VM2VM_HARDWARE) {
- if (find_local_dest(dev, m, &offset, &vlan_tag) != 0) {
+ if (find_local_dest(dev, m, &offset, &vlan_tag) != 0 ||
+ offset > rte_pktmbuf_tailroom(m)) {
rte_pktmbuf_free(m);
return;
}
rte_pktmbuf_free(m);
return;
}
/* Buffer address translation. */
buff_addr = gpa_to_vva(dev, desc->addr);
/* Buffer address translation. */
buff_addr = gpa_to_vva(dev, desc->addr);
- phys_addr = gpa_to_hpa(vdev, desc->addr, desc->len, &addr_type);
+ /* Need check extra VLAN_HLEN size for inserting VLAN tag */
+ phys_addr = gpa_to_hpa(vdev, desc->addr, desc->len + VLAN_HLEN,
+ &addr_type);
if (likely(packet_success < (free_entries - 1)))
/* Prefetch descriptor index. */
if (likely(packet_success < (free_entries - 1)))
/* Prefetch descriptor index. */