Integer underflow and out-of-bounds read (VPP-1442)

[vpp.git] / src / vlib / buffer_node.h

diff --git a/src/vlib/buffer_node.h b/src/vlib/buffer_node.h
index c9f4895..35e15a5 100644 (file)
--- a/src/vlib/buffer_node.h
+++ b/src/vlib/buffer_node.h
@@ -366,10 +366,15 @@ vlib_buffer_enqueue_to_next (vlib_main_t * vm, vlib_node_runtime_t * node,
       n_enqueued = count_trailing_zeros (~bitmap) / 2;
 #else
       u16 x = 0;
-      x |= next_index ^ nexts[1];
-      x |= next_index ^ nexts[2];
-      x |= next_index ^ nexts[3];
-      n_enqueued = (x == 0) ? 4 : 1;
+      if (count + 3 < max)
+       {
+         x |= next_index ^ nexts[1];
+         x |= next_index ^ nexts[2];
+         x |= next_index ^ nexts[3];
+         n_enqueued = (x == 0) ? 4 : 1;
+       }
+      else
+       n_enqueued = 1;
 #endif
 
       if (PREDICT_FALSE (n_enqueued > max))
@@ -443,6 +448,105 @@ vlib_buffer_enqueue_to_next (vlib_main_t * vm, vlib_node_runtime_t * node,
   vlib_put_next_frame (vm, node, next_index, n_left_to_next);
 }
 
+static_always_inline u32
+vlib_buffer_enqueue_to_thread (vlib_main_t * vm, u32 frame_queue_index,
+                              u32 * buffer_indices, u16 * thread_indices,
+                              u32 n_packets, int drop_on_congestion)
+{
+  vlib_thread_main_t *tm = vlib_get_thread_main ();
+  vlib_frame_queue_main_t *fqm;
+  vlib_frame_queue_per_thread_data_t *ptd;
+  u32 n_left = n_packets;
+  u32 drop_list[VLIB_FRAME_SIZE], *dbi = drop_list, n_drop = 0;
+  vlib_frame_queue_elt_t *hf = 0;
+  u32 n_left_to_next_thread = 0, *to_next_thread = 0;
+  u32 next_thread_index, current_thread_index = ~0;
+  int i;
+
+  fqm = vec_elt_at_index (tm->frame_queue_mains, frame_queue_index);
+  ptd = vec_elt_at_index (fqm->per_thread_data, vm->thread_index);
+
+  while (n_left)
+    {
+      next_thread_index = thread_indices[0];
+
+      if (next_thread_index != current_thread_index)
+       {
+
+         if (drop_on_congestion &&
+             is_vlib_frame_queue_congested
+             (frame_queue_index, next_thread_index, fqm->queue_hi_thresh,
+              ptd->congested_handoff_queue_by_thread_index))
+           {
+             dbi[0] = buffer_indices[0];
+             dbi++;
+             n_drop++;
+             goto next;
+           }
+
+         if (hf)
+           hf->n_vectors = VLIB_FRAME_SIZE - n_left_to_next_thread;
+
+         hf = vlib_get_worker_handoff_queue_elt (frame_queue_index,
+                                                 next_thread_index,
+                                                 ptd->handoff_queue_elt_by_thread_index);
+
+         n_left_to_next_thread = VLIB_FRAME_SIZE - hf->n_vectors;
+         to_next_thread = &hf->buffer_index[hf->n_vectors];
+         current_thread_index = next_thread_index;
+       }
+
+      to_next_thread[0] = buffer_indices[0];
+      to_next_thread++;
+      n_left_to_next_thread--;
+
+      if (n_left_to_next_thread == 0)
+       {
+         hf->n_vectors = VLIB_FRAME_SIZE;
+         vlib_put_frame_queue_elt (hf);
+         current_thread_index = ~0;
+         ptd->handoff_queue_elt_by_thread_index[next_thread_index] = 0;
+         hf = 0;
+       }
+
+      /* next */
+    next:
+      thread_indices += 1;
+      buffer_indices += 1;
+      n_left -= 1;
+    }
+
+  if (hf)
+    hf->n_vectors = VLIB_FRAME_SIZE - n_left_to_next_thread;
+
+  /* Ship frames to the thread nodes */
+  for (i = 0; i < vec_len (ptd->handoff_queue_elt_by_thread_index); i++)
+    {
+      if (ptd->handoff_queue_elt_by_thread_index[i])
+       {
+         hf = ptd->handoff_queue_elt_by_thread_index[i];
+         /*
+          * It works better to let the handoff node
+          * rate-adapt, always ship the handoff queue element.
+          */
+         if (1 || hf->n_vectors == hf->last_n_vectors)
+           {
+             vlib_put_frame_queue_elt (hf);
+             ptd->handoff_queue_elt_by_thread_index[i] = 0;
+           }
+         else
+           hf->last_n_vectors = hf->n_vectors;
+       }
+      ptd->congested_handoff_queue_by_thread_index[i] =
+       (vlib_frame_queue_t *) (~0);
+    }
+
+  if (drop_on_congestion && n_drop)
+    vlib_buffer_free (vm, drop_list, n_drop);
+
+  return n_packets - n_drop;
+}
+
 #endif /* included_vlib_buffer_node_h */
 
 /*