diff options
| author |   Steven <sluong@cisco.com> | 2018-09-24 14:23:44 -0700 |
|---|---|---|
| committer |   Damjan Marion <dmarion@me.com> | 2018-09-25 07:40:54 +0000 |
| commit | 8812a68062016e622b33cbae6a21bc073caa918e (patch) | |
| tree | 9f7c72404829f81c97c70e31cc3efe7fc3a04b18 /src | |
| parent | 51a0b0bc3b1b51a7fe1c3cb45214c6de1ff2a865 (diff) | |
vmxnet3: guard against array overflow
Under extreme condition, it is possible for input node to have more than 256 packets available
to process. Add a check to the while loop to prevent overrun buffer_indices and nexts.
Change-Id: Id9830e5c254f04216eb79e864a5460e08cf2e4e5
Signed-off-by: Steven <sluong@cisco.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/plugins/vmxnet3/input.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/plugins/vmxnet3/input.c b/src/plugins/vmxnet3/input.c index e3e8b319835..a0b9cbca578 100644 --- a/src/plugins/vmxnet3/input.c +++ b/src/plugins/vmxnet3/input.c @@ -95,8 +95,9 @@ vmxnet3_device_input_inline (vlib_main_t * vm, vlib_node_runtime_t * node, comp_ring = &rxq->rx_comp_ring; bi = buffer_indices; next = nexts; - while (comp_ring->gen == - (rxq->rx_comp[comp_ring->next].flags & VMXNET3_RXCF_GEN)) + while (PREDICT_TRUE (n_rx_packets < VLIB_FRAME_SIZE) && + (comp_ring->gen == + (rxq->rx_comp[comp_ring->next].flags & VMXNET3_RXCF_GEN))) { vlib_buffer_t *b0; u32 bi0; |