summaryrefslogtreecommitdiffstats
path: root/build-root
diff options
context:
space:
mode:
authorSteven Luong <sluong@cisco.com>2022-08-15 12:45:43 -0700
committerDamjan Marion <dmarion@0xa5.net>2022-08-17 14:23:37 +0000
commitfc025725b895057d16687ebcab22d1bbb0837cba (patch)
tree16ab7ec5db1d6b7f3772feff2e9237b32a2f3742 /build-root
parentae605389253805e07bb293b056e012cdaf5593b2 (diff)
memif: crash on recceiving a bad descriptor
We validate each descriptor via memif_validate_desc_data and set desc_status to non-zero for the corresponding descriptor when the descriptor is bad. However, desc_status is not propagated back to xor_status in memif_validate_desc_data which eventually sets ptd->xor_status. Not setting ptd->xor_status causes us to treat all descriptors as "simple". In that case, when we try to copy also the bad descriptors to the buffers, it results a crash since desc_data is not set to point to the correct memory in the descriptor. The fix is to set xor_status in memif_validate_desc_data such that if there is a bad descriptor in the frame, "is_simple" is set to false and we have to selectively copy only the good descriptors to the buffers. Type: fix Signed-off-by: Steven Luong <sluong@cisco.com> Change-Id: I780f51a42aa0f8745edcddebbe02b2961c183598
Diffstat (limited to 'build-root')
0 files changed, 0 insertions, 0 deletions