diff options
| author |   Steven Luong <sluong@cisco.com> | 2019-10-23 13:28:37 -0700 |
|---|---|---|
| committer | Steven Luong <sluong@cisco.com> | 2019-10-23 13:39:18 -0700 |
| commit | 7331005c16d0e1499080899b2a0676a0cd945595 (patch) | |
| tree | 2ddb0ad8c961ca3e9bebefbe18e0db3f4402018e /src/vnet/devices/virtio/vhost_user_input.c | |
| parent | 00b2d74d1f58b9357e8d955ad7410fb608490904 (diff) | |
devices: vhoost cpu->copy array overflow on tcp jumbo frame (65535 bytes)
We reserve 40 slots in cpu->copy array prior to copy out to avoid overflowing
the array. However, 40 is not enough for the jumbo frame because desceiptor
buffer len is likely at 1536. Change the reserve to 200 and add ASSERT to avoid
encountering the same problem in the future.
Type: fix
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: Ibf0c03c4b4f33e781d5be8679ccd6c3a4b4a646d
Diffstat (limited to 'src/vnet/devices/virtio/vhost_user_input.c')
| -rw-r--r-- | src/vnet/devices/virtio/vhost_user_input.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/vnet/devices/virtio/vhost_user_input.c b/src/vnet/devices/virtio/vhost_user_input.c index 2d90ed1224d..ef35d23a03c 100644 --- a/src/vnet/devices/virtio/vhost_user_input.c +++ b/src/vnet/devices/virtio/vhost_user_input.c @@ -654,6 +654,7 @@ vhost_user_if_input (vlib_main_t * vm, } /* Prepare a copy order executed later for the data */ + ASSERT (copy_len < VHOST_USER_COPY_ARRAY_N); vhost_copy_t *cpy = &cpu->copy[copy_len]; copy_len++; u32 desc_data_l = desc_table[desc_current].len - desc_data_offset; |