From 7b4482e04bcabbfcfa3f47198e27c3b1bb4d1a94 Mon Sep 17 00:00:00 2001 From: Pablo de Lara Date: Tue, 5 Aug 2014 11:18:20 +0100 Subject: [PATCH] pcap: fix Rx crash Normally, bufs[i] stores the mbuf pointer, the index of buf[i] is the loop count i, but if header.len > buf_size, DPDK will free the mbuf, but the loop count i still increases, so some of the items in bufs[] might be NULL pointer, causing a potential DPDK core. Using num_rx as the index for bufs[] solves the problem. Signed-off-by: Pablo de Lara Tested-by: Jiajia SunX Acked-by: Thomas Monjalon --- lib/librte_pmd_pcap/rte_eth_pcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/librte_pmd_pcap/rte_eth_pcap.c b/lib/librte_pmd_pcap/rte_eth_pcap.c index c77ee25077..eebe768461 100644 --- a/lib/librte_pmd_pcap/rte_eth_pcap.c +++ b/lib/librte_pmd_pcap/rte_eth_pcap.c @@ -154,7 +154,7 @@ eth_pcap_rx(void *queue, rte_memcpy(mbuf->pkt.data, packet, header.len); mbuf->pkt.data_len = (uint16_t)header.len; mbuf->pkt.pkt_len = mbuf->pkt.data_len; - bufs[i] = mbuf; + bufs[num_rx] = mbuf; num_rx++; } else { /* pcap packet will not fit in the mbuf, so drop packet */ -- 2.20.1