mbuf: fix NULL freeing when debug enabled

[dpdk.git] / lib / librte_mbuf / rte_mbuf.c

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 2e08b9e..937fd70 100644 (file)
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned n,
 void
 rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
 {
-       const struct rte_mbuf *m_seg;
-       unsigned nb_segs;
+       unsigned int nb_segs, pkt_len;
 
        if (m == NULL)
                rte_panic("mbuf is NULL\n");
@@ -224,14 +223,22 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
        if (is_header == 0)
                return;
 
+       /* data_len is supposed to be not more than pkt_len */
+       if (m->data_len > m->pkt_len)
+               rte_panic("bad data_len\n");
+
        nb_segs = m->nb_segs;
-       m_seg = m;
-       while (m_seg && nb_segs != 0) {
-               m_seg = m_seg->next;
-               nb_segs--;
-       }
-       if (nb_segs != 0)
+       pkt_len = m->pkt_len;
+
+       do {
+               nb_segs -= 1;
+               pkt_len -= m->data_len;
+       } while ((m = m->next) != NULL);
+
+       if (nb_segs)
                rte_panic("bad nb_segs\n");
+       if (pkt_len)
+               rte_panic("bad pkt_len\n");
 }
 
 /* dump a mbuf on console */
@@ -239,7 +246,7 @@ void
 rte_pktmbuf_dump(FILE *f, const struct rte_mbuf *m, unsigned dump_len)
 {
        unsigned int len;
-       unsigned nb_segs;
+       unsigned int nb_segs;
 
        __rte_mbuf_sanity_check(m, 1);