aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJim Gibson <gibson+fdio@cisco.com>2017-03-27 20:19:54 +0000
committerDamjan Marion <dmarion.lists@gmail.com>2017-03-29 21:50:40 +0000
commitee403b722f9b3fde7c80c90066a4bfebffd2909f (patch)
tree472d9545b7b0b672f3042a1bec87069eb3d3713d
parent39cdca35c54f305239580c9a406ece1e8331894e (diff)
af_packet driver failure to check VLIB_BUFFER_NEXT_PRESENT flag
af_packet driver must check that VLIB_BUFFER_NEXT_PRESENT flag is set when walking vlib_buffer_t next_buffer chain on transmit. On buffer allocation: - next_buffer is not and may contain a stale invalid value that should be ignored if not overwritten by a valid value. - VLIB_BUFFER_NEXT_PRESENT flag is cleared and only set if a valid value is written to next_buffer. Change-Id: Iebf76ce8eea24a0d63c7bf749e672d6a232c80e7 Signed-off-by: Jim Gibson <gibson+fdio@cisco.com>
-rw-r--r--src/vnet/devices/af_packet/device.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/vnet/devices/af_packet/device.c b/src/vnet/devices/af_packet/device.c
index e3bf9bbc51b..9a94fc5e4a9 100644
--- a/src/vnet/devices/af_packet/device.c
+++ b/src/vnet/devices/af_packet/device.c
@@ -125,7 +125,8 @@ af_packet_interface_tx (vlib_main_t * vm,
vlib_buffer_get_current (b0), len);
offset += len;
}
- while ((bi = b0->next_buffer));
+ while ((bi =
+ (b0->flags & VLIB_BUFFER_NEXT_PRESENT) ? b0->next_buffer : 0));
tph->tp_len = tph->tp_snaplen = offset;
tph->tp_status = TP_STATUS_SEND_REQUEST;