The code sets f->n_vectors = n_to_send, but it can bail out of the
loop if vlib_buffer_copy(...) returns 0.
Need to fix f->n_vectors in the error return path, or we enqueue some
number of 0xfefefefe buffer indices in a debug image or worse in a
production image.
Type: fix
Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I2d886266006c6c1c2f9ef8e3b95eb46ac6c0b3df
* we did not enqueue it here yet.
*/
ship_and_ret:
* we did not enqueue it here yet.
*/
ship_and_ret:
+ ASSERT (n_to_send <= f->n_vectors);
+ f->n_vectors -= n_to_send;
n_sent += f->n_vectors;
vlib_put_frame_to_node (vm, lookup_node_index, f);
return n_sent;
n_sent += f->n_vectors;
vlib_put_frame_to_node (vm, lookup_node_index, f);
return n_sent;