vmxnet3: invoke vlib_buffer_enqueue_to_next() with the wrong buffers for chain buffers 00/14900/2
authorSteven <sluong@cisco.com>
Wed, 19 Sep 2018 22:30:25 +0000 (15:30 -0700)
committerFlorin Coras <florin.coras@gmail.com>
Thu, 20 Sep 2018 02:46:15 +0000 (02:46 +0000)
commit6e06d66795a3948bb75cf5fd1cfc5745fec29505
tree3df7c77aea4d560a527bd86053ef0b9c748ebf58
parentcae64f896d78c4048acc9ddbe88f666f2053f02f
vmxnet3: invoke vlib_buffer_enqueue_to_next() with the wrong buffers for chain buffers

If we invoke the subject API with 2 buffers, each with 2 chains, the content of
buffers[0] should be head of 1st buffer, and content of buffer[1] should be
head of 2nd buffer.

What the code did was to put
buffers[0] = head of 1st buffer
buffers[1] = next chain of 1st buffer
buffers[2] = head of 2nd buffer
buffers[3] = next chain of 2nd buffer

This is wrong and can cause crash.

The fix is to only increment bi when the entire packet is found which may consist
of multiple fragments.

Change-Id: If02cd5186a039d7a6c08a0959112840bdb242317
Signed-off-by: Steven <sluong@cisco.com>
src/plugins/vmxnet3/input.c