From: Dave Barach <dave@barachs.net>
Date: Wed, 8 Apr 2020 16:03:32 +0000 (-0400)
Subject: ping: fix buffer allocator error handling
X-Git-Tag: v20.09-rc0~244
X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=commitdiff_plain;h=8324c55f95dd5ddbf1f5f9c47907204a12e152ef

ping: fix buffer allocator error handling

The code sets f->n_vectors = n_to_send, but it can bail out of the
loop if vlib_buffer_copy(...) returns 0.

Need to fix f->n_vectors in the error return path, or we enqueue some
number of 0xfefefefe buffer indices in a debug image or worse in a
production image.

Type: fix

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I2d886266006c6c1c2f9ef8e3b95eb46ac6c0b3df
---

diff --git a/src/plugins/ping/ping.c b/src/plugins/ping/ping.c
index 7045648d872..f56f44ffb26 100755
--- a/src/plugins/ping/ping.c
+++ b/src/plugins/ping/ping.c
@@ -933,6 +933,8 @@ ip46_enqueue_packet (vlib_main_t * vm, vlib_buffer_t * b0, u32 burst,
    * we did not enqueue it here yet.
    */
 ship_and_ret:
+  ASSERT (n_to_send <= f->n_vectors);
+  f->n_vectors -= n_to_send;
   n_sent += f->n_vectors;
   vlib_put_frame_to_node (vm, lookup_node_index, f);
   return n_sent;