diff mbox series

virtio: fix buffer leak on vlan insert

Message ID 20190405000343.24424-1-stephen@networkplumber.org (mailing list archive)
State Superseded, archived
Delegated to: Maxime Coquelin
Headers
Series virtio: fix buffer leak on vlan insert |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation fail Compilation issues

Commit Message

Stephen Hemminger April 5, 2019, 12:03 a.m. UTC 
The function rte_vlan_insert may allocate a new buffer for the
vlan header and return a different mbuf than originally passed.
In this case, the stored mbuf in txm[] array could point to wrong
buffer.

Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/virtio/virtio_rxtx.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Jens Freimann April 5, 2019, 7:43 a.m. UTC | #1 
On Thu, Apr 04, 2019 at 05:03:43PM -0700, Stephen Hemminger wrote:
>The function rte_vlan_insert may allocate a new buffer for the
>vlan header and return a different mbuf than originally passed.
>In this case, the stored mbuf in txm[] array could point to wrong
>buffer.
>
>Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
>Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
>---
> drivers/net/virtio/virtio_rxtx.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/drivers/net/virtio/virtio_rxtx.c b/drivers/net/virtio/virtio_rxtx.c
>index e6f3706d6fe1..2ae4232c181d 100644
>--- a/drivers/net/virtio/virtio_rxtx.c
>+++ b/drivers/net/virtio/virtio_rxtx.c
>@@ -2003,6 +2003,8 @@ virtio_xmit_pkts_packed(void *tx_queue, struct rte_mbuf **tx_pkts,
> 				rte_pktmbuf_free(txm);
> 				continue;
> 			}
>+			/* vlan_insert may add a header mbuf */
>+			tx_pkts[nb_tx] = txm;
> 		}
>
> 		/* optimize ring usage */

Good catch. I think we have the same bug in virtio_xmit_pkts() and
virtio_xmit_pkts_inorder() and should fix these as well. 


Thanks!

regards,
Jens
diff mbox series

Patch

diff --git a/drivers/net/virtio/virtio_rxtx.c b/drivers/net/virtio/virtio_rxtx.c
index e6f3706d6fe1..2ae4232c181d 100644
--- a/drivers/net/virtio/virtio_rxtx.c
+++ b/drivers/net/virtio/virtio_rxtx.c
@@ -2003,6 +2003,8 @@  virtio_xmit_pkts_packed(void *tx_queue, struct rte_mbuf **tx_pkts,
 				rte_pktmbuf_free(txm);
 				continue;
 			}
+			/* vlan_insert may add a header mbuf */
+			tx_pkts[nb_tx] = txm;
 		}
 
 		/* optimize ring usage */