From: Ilya V. Matveychikov <matvejchikov@gmail.com>
Date: Sat, 9 Dec 2017 21:39:18 +0000 (+0300)
Subject: mbuf: check sanity of data and packet lengths
X-Git-Tag: spdx-start~729
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=4ba9f1f910d3c7658ed857893dfb11027e87f85e;p=dpdk.git

mbuf: check sanity of data and packet lengths

Update rte_mbuf_sanity_check() to check sanity of data_len and pkt_len
fields. For segmented packets it is supposed that head's pkt_len field
should be the sum of all segments data_len values.

Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>
Acked-by: Olivier Matz <olivier.matz@6wind.com>
---

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 7543662f79..937fd70ea1 100644
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned n,
 void
 rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
 {
-	const struct rte_mbuf *m_seg;
-	unsigned int nb_segs;
+	unsigned int nb_segs, pkt_len;
 
 	if (m == NULL)
 		rte_panic("mbuf is NULL\n");
@@ -224,14 +223,22 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
 	if (is_header == 0)
 		return;
 
+	/* data_len is supposed to be not more than pkt_len */
+	if (m->data_len > m->pkt_len)
+		rte_panic("bad data_len\n");
+
 	nb_segs = m->nb_segs;
-	m_seg = m;
-	while (m_seg && nb_segs != 0) {
-		m_seg = m_seg->next;
-		nb_segs--;
-	}
-	if (nb_segs != 0)
+	pkt_len = m->pkt_len;
+
+	do {
+		nb_segs -= 1;
+		pkt_len -= m->data_len;
+	} while ((m = m->next) != NULL);
+
+	if (nb_segs)
 		rte_panic("bad nb_segs\n");
+	if (pkt_len)
+		rte_panic("bad pkt_len\n");
 }
 
 /* dump a mbuf on console */