diff options
| author |   Jim Gibson <gibson+fdio@cisco.com> | 2017-03-27 20:19:54 +0000 |
|---|---|---|
| committer |   Damjan Marion <dmarion.lists@gmail.com> | 2017-03-29 21:50:40 +0000 |
| commit | ee403b722f9b3fde7c80c90066a4bfebffd2909f (patch) | |
| tree | 472d9545b7b0b672f3042a1bec87069eb3d3713d | |
| parent | 39cdca35c54f305239580c9a406ece1e8331894e (diff) | |
af_packet driver failure to check VLIB_BUFFER_NEXT_PRESENT flag
af_packet driver must check that VLIB_BUFFER_NEXT_PRESENT flag is set
when walking vlib_buffer_t next_buffer chain on transmit.
On buffer allocation:
- next_buffer is not and may contain a stale invalid value that
should be ignored if not overwritten by a valid value.
- VLIB_BUFFER_NEXT_PRESENT flag is cleared and only set
if a valid value is written to next_buffer.
Change-Id: Iebf76ce8eea24a0d63c7bf749e672d6a232c80e7
Signed-off-by: Jim Gibson <gibson+fdio@cisco.com>
| -rw-r--r-- | src/vnet/devices/af_packet/device.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/vnet/devices/af_packet/device.c b/src/vnet/devices/af_packet/device.c index e3bf9bbc51b..9a94fc5e4a9 100644 --- a/src/vnet/devices/af_packet/device.c +++ b/src/vnet/devices/af_packet/device.c @@ -125,7 +125,8 @@ af_packet_interface_tx (vlib_main_t * vm, vlib_buffer_get_current (b0), len); offset += len; } - while ((bi = b0->next_buffer)); + while ((bi = + (b0->flags & VLIB_BUFFER_NEXT_PRESENT) ? b0->next_buffer : 0)); tph->tp_len = tph->tp_snaplen = offset; tph->tp_status = TP_STATUS_SEND_REQUEST; |