[dpdk-dev] packet data access bug in bpf and pdump libs

[Stephen Hemminger]

On Wed, 9 Oct 2019 11:11:46 +0000
"Ananyev, Konstantin" <konstantin.ananyev at intel.com> wrote:

> Hi Morten,
> 
> > 
> > Hi Konstantin and Stephen,
> > 
> > I just noticed the same bug in your bpf and pcap libraries:
> > 
> > You are using rte_pktmbuf_mtod(), but should be using rte_pktmbuf_read(). Otherwise you cannot read data across multiple segments.  
> 
> In plain data buffer mode expected input for BPF program is start of first segment packet data.
> Other segments are simply not available to BPF program in that mode.
> AFAIK, cBPF uses the same model.
> 
> > 
> > 
> > Med venlig hilsen / kind regards
> > - Morten Brørup  
> 

For packet capture, the BPF program is only allowed to look at first segment.
pktmbuf_read is expensive and can cause a copy.