From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from rere.qmqm.pl (rere.qmqm.pl [84.10.57.10]) by dpdk.org (Postfix) with ESMTP id 38F8A10A7 for ; Tue, 13 Dec 2016 02:08:19 +0100 (CET) Received: by rere.qmqm.pl (Postfix, from userid 1000) id B6E126082; Tue, 13 Dec 2016 02:08:18 +0100 (CET) Message-Id: <9c5b028d62c8422031e451c91232d34e562cf4cf.1481590851.git.mirq-linux@rere.qmqm.pl> In-Reply-To: References: From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To: dev@dpdk.org Date: Tue, 13 Dec 2016 02:08:18 +0100 (CET) Subject: [dpdk-dev] [PATCH 09/13] PMD/af_packet: guard against buffer overruns in TX path X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 01:08:19 -0000 Signed-off-by: Michał Mirosław --- drivers/net/af_packet/rte_eth_af_packet.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c index b1005c6..2c81d25 100644 --- a/drivers/net/af_packet/rte_eth_af_packet.c +++ b/drivers/net/af_packet/rte_eth_af_packet.c @@ -83,6 +83,7 @@ struct pkt_rx_queue { struct pkt_tx_queue { int sockfd; + unsigned frame_data_size; struct iovec *rd; uint8_t *map; @@ -206,13 +207,20 @@ eth_af_packet_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) framenum = pkt_q->framenum; ppd = (struct tpacket2_hdr *) pkt_q->rd[framenum].iov_base; for (i = 0; i < nb_pkts; i++) { + mbuf = *bufs++; + + /* drop oversized packets */ + if (rte_pktmbuf_data_len(mbuf) > pkt_q->frame_data_size) { + rte_pktmbuf_free(mbuf); + continue; + } + /* point at the next incoming frame */ if ((ppd->tp_status != TP_STATUS_AVAILABLE) && (poll(&pfd, 1, -1) < 0)) - continue; + break; /* copy the tx frame data */ - mbuf = bufs[num_tx]; pbuf = (uint8_t *) ppd + TPACKET2_HDRLEN - sizeof(struct sockaddr_ll); memcpy(pbuf, rte_pktmbuf_mtod(mbuf, void*), rte_pktmbuf_data_len(mbuf)); @@ -231,13 +239,13 @@ eth_af_packet_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) /* kick-off transmits */ if (sendto(pkt_q->sockfd, NULL, 0, MSG_DONTWAIT, NULL, 0) == -1) - return 0; /* error sending -- no packets transmitted */ + num_tx = 0; /* error sending -- no packets transmitted */ pkt_q->framenum = framenum; pkt_q->tx_pkts += num_tx; - pkt_q->err_pkts += nb_pkts - num_tx; + pkt_q->err_pkts += i - num_tx; pkt_q->tx_bytes += num_tx_bytes; - return num_tx; + return i; } static int @@ -633,6 +641,7 @@ rte_pmd_init_internals(const char *name, tx_queue = &((*internals)->tx_queue[q]); tx_queue->framecount = req->tp_frame_nr; + tx_queue->frame_data_size = req->tp_frame_size - TPACKET2_HDRLEN + sizeof(struct sockaddr_ll); tx_queue->map = rx_queue->map + req->tp_block_size * req->tp_block_nr; -- 2.10.2