[dpdk-dev] [PATCH v2 08/13] PMD/af_packet: guard against buffer overruns in RX path

[John W. Linville]

On Tue, Dec 13, 2016 at 02:28:34AM +0100, Michał Mirosław wrote:
> 
> Signed-off-by: Michał Mirosław <michal.miroslaw at atendesoftware.pl>

Acked-by: John W. Linville <linville at tuxdriver.com>

> ---
>  drivers/net/af_packet/rte_eth_af_packet.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
> index ff45068..5599e02 100644
> --- a/drivers/net/af_packet/rte_eth_af_packet.c
> +++ b/drivers/net/af_packet/rte_eth_af_packet.c
> @@ -370,18 +370,19 @@ eth_rx_queue_setup(struct rte_eth_dev *dev,
>  {
>  	struct pmd_internals *internals = dev->data->dev_private;
>  	struct pkt_rx_queue *pkt_q = &internals->rx_queue[rx_queue_id];
> -	uint16_t buf_size;
> +	unsigned int buf_size, data_size;
>  
>  	pkt_q->mb_pool = mb_pool;
>  
>  	/* Now get the space available for data in the mbuf */
> -	buf_size = (uint16_t)(rte_pktmbuf_data_room_size(pkt_q->mb_pool) -
> -		RTE_PKTMBUF_HEADROOM);
> +	buf_size = rte_pktmbuf_data_room_size(pkt_q->mb_pool) - RTE_PKTMBUF_HEADROOM;
> +	data_size = internals->req.tp_frame_size;
> +	data_size -= TPACKET2_HDRLEN - sizeof(struct sockaddr_ll);
>  
> -	if (ETH_FRAME_LEN > buf_size) {
> +	if (data_size > buf_size) {
>  		RTE_LOG(ERR, PMD,
>  			"%s: %d bytes will not fit in mbuf (%d bytes)\n",
> -			dev->data->name, ETH_FRAME_LEN, buf_size);
> +			dev->data->name, data_size, buf_size);
>  		return -ENOMEM;
>  	}
>  
> -- 
> 2.10.2
> 
> 

-- 
John W. Linville		Someday the world will need a hero, and you
linville at tuxdriver.com			might be all we have.  Be ready.