DPDK usage discussions
 help / color / mirror / Atom feed
* IP reassembly can cause memory corruption?
@ 2021-12-08 20:49 Purnima, Kompella V
  0 siblings, 0 replies; only message in thread
From: Purnima, Kompella V @ 2021-12-08 20:49 UTC (permalink / raw)
  To: users

[-- Attachment #1: Type: text/plain, Size: 728 bytes --]

HI

I am using DPDK 19.11 version. Following are my findings

struct rte_ip_frag_death_row {
       uint32_t cnt;          /**< number of mbufs currently on death row */
       struct rte_mbuf *row[IP_FRAG_DEATH_ROW_MBUF_LEN];
       /**< mbufs to be freed */
};

#define      IP_FRAG_MBUF2DR(dr, mb)   ((dr)->row[(dr)->cnt++] = (mb))



When calling IP_FRAG_MBUF2DR, there is no check for cnt < IP_FRAG_DEATH_ROW_MBUF_LEN.
So whenever (cnt >= IP_FRAG_DEATH_ROW_MBUF_LEN) happens IP_FRAG_MBUF2DR will corrupt memory due to array-bound overflow.

Late arrival or non-arrival of all fragments of packets - any of these common scenarios can cause the corruption!!

Is this a known issue?

Thanks
Purnima



[-- Attachment #2: Type: text/html, Size: 7607 bytes --]

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-12-08 20:49 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-08 20:49 IP reassembly can cause memory corruption? Purnima, Kompella V

DPDK usage discussions

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.dpdk.org/users/0 users/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 users users/ http://inbox.dpdk.org/users \
		users@dpdk.org
	public-inbox-index users

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.users


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git