From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id 2047EA046B for ; Tue, 25 Jun 2019 20:26:56 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 5434E1B993; Tue, 25 Jun 2019 20:26:55 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id 5B3C31B956 for ; Tue, 25 Jun 2019 20:26:54 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Jun 2019 11:26:53 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,416,1557212400"; d="scan'208";a="169851688" Received: from sivswdev08.ir.intel.com ([10.237.217.47]) by FMSMGA003.fm.intel.com with ESMTP; 25 Jun 2019 11:26:52 -0700 From: Konstantin Ananyev To: dev@dpdk.org Cc: akhil.goyal@nxp.com, Konstantin Ananyev Date: Tue, 25 Jun 2019 19:26:44 +0100 Message-Id: <20190625182644.8401-1-konstantin.ananyev@intel.com> X-Mailer: git-send-email 2.18.0 Subject: [dpdk-dev] [PATCH] ipsec: packet with null encryption can cause a segfault X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" mbuf_get_seg_ofs() doesn't handle the case when requested offset equals to packet length. Though it is a valid situation for algorithms with no ICV data (IPsec with null encryption as an example). Fixes: 12a0423236a9 ("ipsec: support multi-segment packets") Signed-off-by: Konstantin Ananyev --- lib/librte_ipsec/misc.h | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/lib/librte_ipsec/misc.h b/lib/librte_ipsec/misc.h index b0cafef4e..fe4641bfc 100644 --- a/lib/librte_ipsec/misc.h +++ b/lib/librte_ipsec/misc.h @@ -46,16 +46,22 @@ move_bad_mbufs(struct rte_mbuf *mb[], const uint32_t bad_idx[], uint32_t nb_mb, static inline struct rte_mbuf * mbuf_get_seg_ofs(struct rte_mbuf *mb, uint32_t *ofs) { - uint32_t k, n; + uint32_t k, n, plen; struct rte_mbuf *ms; - ms = mb; + plen = mb->pkt_len; n = *ofs; - for (k = rte_pktmbuf_data_len(ms); n >= k; - k = rte_pktmbuf_data_len(ms)) { - ms = ms->next; - n -= k; + if (n == plen) { + ms = rte_pktmbuf_lastseg(mb); + n = n + rte_pktmbuf_data_len(ms) - plen; + } else { + ms = mb; + for (k = rte_pktmbuf_data_len(ms); n >= k; + k = rte_pktmbuf_data_len(ms)) { + ms = ms->next; + n -= k; + } } *ofs = n; -- 2.17.1