net/vmxnet3: handle bad host framing

The VMXNet3 protocol has a start-of-packet (SOP) and end-of-packet (EOP)
marker. If there was a bug where mbuf arrived without SOP the code that
chains the mbuf would dereference a null pointer.
Also, record any mbuf's dropped in statistics.

Although did the initial code no longer have access to VMware.
Compile tested only!

Coverity issue: 124563
Fixes: 8ee787ce80a8 ("vmxnet3: remove asserts that confuse coverity")
Cc: stable@dpdk.org
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Yong Wang <yongwang@vmware.com>

diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index dd99684..73e270f 100644 (file)
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -950,13 +950,17 @@ vmxnet3_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 
                        RTE_ASSERT(rxd->btype == VMXNET3_RXD_BTYPE_BODY);
 
-                       if (rxm->data_len) {
+                       if (likely(start && rxm->data_len > 0)) {
                                start->pkt_len += rxm->data_len;
                                start->nb_segs++;
 
                                rxq->last_seg->next = rxm;
                                rxq->last_seg = rxm;
                        } else {
+                               PMD_RX_LOG(ERR, "Error received empty or out of order frame.");
+                               rxq->stats.drop_total++;
+                               rxq->stats.drop_err++;
+
                                rte_pktmbuf_free_seg(rxm);
                        }
                }