diff mbox

[dpdk-dev,1/2] mbuf: check sanity of data_len and pkt_len as well

Message ID DEC79BD0-6A0F-453F-9E7E-0C7E3C9234BB@gmail.com (mailing list archive)
State Superseded, archived
Headers

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Ilya Matveychikov Nov. 16, 2017, 2:04 p.m. UTC 
  Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>
---
 lib/librte_mbuf/rte_mbuf.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

--
2.15.0

Comments

Olivier Matz Dec. 1, 2017, 4:37 p.m. UTC | #1 
Hi Ilya,

On Thu, Nov 16, 2017 at 06:04:43PM +0400, Ilya Matveychikov wrote:
> Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>

Please, add a commit log.

> ---
>  lib/librte_mbuf/rte_mbuf.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)
> 
> diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
> index 7543662f7..491685c36 100644
> --- a/lib/librte_mbuf/rte_mbuf.c
> +++ b/lib/librte_mbuf/rte_mbuf.c
> @@ -202,8 +202,7 @@ rte_pktmbuf_pool_create(const char *name, unsigned n,
>  void
>  rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
>  {
> -	const struct rte_mbuf *m_seg;
> -	unsigned int nb_segs;
> +	unsigned int nb_segs, pkt_len;
> 
>  	if (m == NULL)
>  		rte_panic("mbuf is NULL\n");
> @@ -220,18 +219,26 @@ rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
>  	if ((cnt == 0) || (cnt == UINT16_MAX))
>  		rte_panic("bad ref cnt\n");
> 
> +	/* data_len supposed to be not more than pkt_len */
> +	if (m->data_len > m->pkt_len)
> +		rte_panic("bad data_len\n");
> +

This check should only be done if is_header == 1.
diff mbox

Patch

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 7543662f7..491685c36 100644
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -202,8 +202,7 @@  rte_pktmbuf_pool_create(const char *name, unsigned n,
 void
 rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
 {
-	const struct rte_mbuf *m_seg;
-	unsigned int nb_segs;
+	unsigned int nb_segs, pkt_len;

 	if (m == NULL)
 		rte_panic("mbuf is NULL\n");
@@ -220,18 +219,26 @@  rte_mbuf_sanity_check(const struct rte_mbuf *m, int is_header)
 	if ((cnt == 0) || (cnt == UINT16_MAX))
 		rte_panic("bad ref cnt\n");

+	/* data_len supposed to be not more than pkt_len */
+	if (m->data_len > m->pkt_len)
+		rte_panic("bad data_len\n");
+
 	/* nothing to check for sub-segments */
 	if (is_header == 0)
 		return;

 	nb_segs = m->nb_segs;
-	m_seg = m;
-	while (m_seg && nb_segs != 0) {
-		m_seg = m_seg->next;
-		nb_segs--;
-	}
-	if (nb_segs != 0)
+	pkt_len = m->pkt_len;
+
+	do {
+		nb_segs -= 1;
+		pkt_len -= m->data_len;
+	} while ((m = m->next) != NULL);
+
+	if (nb_segs)
 		rte_panic("bad nb_segs\n");
+	if (pkt_len)
+		rte_panic("bad pkt_len\n");
 }

 /* dump a mbuf on console */