* IP reassembly can cause memory corruption?
@ 2021-12-08 20:49 Purnima, Kompella V
0 siblings, 0 replies; only message in thread
From: Purnima, Kompella V @ 2021-12-08 20:49 UTC (permalink / raw)
To: users
[-- Attachment #1: Type: text/plain, Size: 728 bytes --]
HI
I am using DPDK 19.11 version. Following are my findings
struct rte_ip_frag_death_row {
uint32_t cnt; /**< number of mbufs currently on death row */
struct rte_mbuf *row[IP_FRAG_DEATH_ROW_MBUF_LEN];
/**< mbufs to be freed */
};
#define IP_FRAG_MBUF2DR(dr, mb) ((dr)->row[(dr)->cnt++] = (mb))
When calling IP_FRAG_MBUF2DR, there is no check for cnt < IP_FRAG_DEATH_ROW_MBUF_LEN.
So whenever (cnt >= IP_FRAG_DEATH_ROW_MBUF_LEN) happens IP_FRAG_MBUF2DR will corrupt memory due to array-bound overflow.
Late arrival or non-arrival of all fragments of packets - any of these common scenarios can cause the corruption!!
Is this a known issue?
Thanks
Purnima
[-- Attachment #2: Type: text/html, Size: 7607 bytes --]
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-12-08 20:49 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-08 20:49 IP reassembly can cause memory corruption? Purnima, Kompella V
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).