From 4ba9f1f910d3c7658ed857893dfb11027e87f85e Mon Sep 17 00:00:00 2001 From: "Ilya V. Matveychikov" Date: Sun, 10 Dec 2017 00:39:18 +0300 Subject: [PATCH] mbuf: check sanity of data and packet lengths Update rte_mbuf_sanity_check() to check sanity of data_len and pkt_len fields. For segmented packets it is supposed that head's pkt_len field should be the sum of all segments data_len values. Signed-off-by: Ilya V. Matveychikov Acked-by: Olivier Matz --- lib/librte_mbuf/rte_mbuf.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c index 7543662f79..937fd70ea1 100644 --- a/lib/librte_mbuf/rte_mbuf.c +++ b/lib/librte_mbuf/rte_mbuf.c @@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned n, void rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header) { - const struct rte_mbuf *m_seg; - unsigned int nb_segs; + unsigned int nb_segs, pkt_len; if (m == NULL) rte_panic("mbuf is NULL\n"); @@ -224,14 +223,22 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header) if (is_header == 0) return; + /* data_len is supposed to be not more than pkt_len */ + if (m->data_len > m->pkt_len) + rte_panic("bad data_len\n"); + nb_segs = m->nb_segs; - m_seg = m; - while (m_seg && nb_segs != 0) { - m_seg = m_seg->next; - nb_segs--; - } - if (nb_segs != 0) + pkt_len = m->pkt_len; + + do { + nb_segs -= 1; + pkt_len -= m->data_len; + } while ((m = m->next) != NULL); + + if (nb_segs) rte_panic("bad nb_segs\n"); + if (pkt_len) + rte_panic("bad pkt_len\n"); } /* dump a mbuf on console */ -- 2.20.1