🐞 fix: Fix mbufs_to_send array out of bounds.v4.8.3-20240423

Fix mbufs_to_send array out of bounds.

1 files changed, 65 insertions, 53 deletions

diff --git a/service/src/node_phydev.c b/service/src/node_phydev.c
index f4f4741..ba5b219 100644
--- a/service/src/node_phydev.c
+++ b/service/src/node_phydev.c
@@ -662,71 +662,83 @@ static __rte_always_inline uint16_t dpdk_dev_tx_node_process(struct rte_graph *
     df_calculate_packet_input(&stat_per_core->tx_df, DF_MR_DEFAULT, (struct rte_mbuf **)objs, cnt);
 #endif
 
-    struct rte_mbuf * mbufs_to_send[RTE_GRAPH_BURST_SIZE];
-    unsigned int nr_mbufs_to_send = 0;
+    uint16_t n_left_from = cnt;
+    struct rte_mbuf ** pkts = (struct rte_mbuf **)objs;
 
-    struct rte_mbuf * mbufs_to_drop[RTE_GRAPH_BURST_SIZE];
-    unsigned int nr_mbufs_to_drop = 0;
-
-    unsigned int counter_tx_meter_green = 0;
-    unsigned int counter_tx_meter_yellow = 0;
-    unsigned int counter_tx_meter_red = 0;
-
-    if (dpdk_dev_desc->en_tx_meter)
+    while (n_left_from > 0)
     {
-        struct rte_meter_srtcm * meter = dpdk_dev_desc->tx_meter[graph->id];
-        struct rte_meter_srtcm_profile * profile = dpdk_dev_desc->tx_meter_profile[graph->id];
-        for (unsigned int i = 0; i < cnt; i++)
-        {
-            struct rte_mbuf * mbuf = (struct rte_mbuf *)objs[i];
-            uint64_t tsc = rte_get_timer_cycles();
-            enum rte_color color = rte_meter_srtcm_color_blind_check(meter, profile, tsc, mbuf->pkt_len);
+        struct rte_mbuf * mbufs_to_send[RTE_GRAPH_BURST_SIZE];
+        unsigned int nr_mbufs_to_send = 0;
 
-            switch (color)
-            {
-            case RTE_COLORS:
-            case RTE_COLOR_GREEN:
-                mbufs_to_send[nr_mbufs_to_send++] = mbuf;
-                counter_tx_meter_green++;
-                break;
+        struct rte_mbuf * mbufs_to_drop[RTE_GRAPH_BURST_SIZE];
+        unsigned int nr_mbufs_to_drop = 0;
 
-            case RTE_COLOR_YELLOW:
-                mbufs_to_send[nr_mbufs_to_send++] = mbuf;
-                do_tx_burst(graph, node, dev_desc, mbufs_to_send, nr_mbufs_to_send);
-                nr_mbufs_to_send = 0;
+        unsigned int counter_tx_meter_green = 0;
+        unsigned int counter_tx_meter_yellow = 0;
+        unsigned int counter_tx_meter_red = 0;
 
-                rte_delay_us_block(dpdk_dev_desc->tx_meter_yellow_pkt_delay_us);
-                counter_tx_meter_yellow++;
-                break;
+        uint16_t nr_curr_send = n_left_from > RTE_DIM(mbufs_to_send) ? RTE_DIM(mbufs_to_send) : n_left_from;
 
-            case RTE_COLOR_RED:
-                stat_per_core->tx_meter_red++;
-                mbufs_to_drop[nr_mbufs_to_drop++] = mbuf;
-                break;
+        n_left_from -= nr_curr_send;
+
+        if (dpdk_dev_desc->en_tx_meter)
+        {
+            struct rte_meter_srtcm * meter = dpdk_dev_desc->tx_meter[graph->id];
+            struct rte_meter_srtcm_profile * profile = dpdk_dev_desc->tx_meter_profile[graph->id];
+            for (unsigned int i = 0; i < nr_curr_send; i++)
+            {
+                struct rte_mbuf * mbuf = (struct rte_mbuf *)pkts[i];
+                uint64_t tsc = rte_get_timer_cycles();
+                enum rte_color color = rte_meter_srtcm_color_blind_check(meter, profile, tsc, mbuf->pkt_len);
+
+                switch (color)
+                {
+                case RTE_COLORS:
+                case RTE_COLOR_GREEN:
+                    mbufs_to_send[nr_mbufs_to_send++] = mbuf;
+                    counter_tx_meter_green++;
+                    break;
+
+                case RTE_COLOR_YELLOW:
+                    mbufs_to_send[nr_mbufs_to_send++] = mbuf;
+                    do_tx_burst(graph, node, dev_desc, mbufs_to_send, nr_mbufs_to_send);
+                    nr_mbufs_to_send = 0;
+
+                    rte_delay_us_block(dpdk_dev_desc->tx_meter_yellow_pkt_delay_us);
+                    counter_tx_meter_yellow++;
+                    break;
+
+                case RTE_COLOR_RED:
+                    stat_per_core->tx_meter_red++;
+                    mbufs_to_drop[nr_mbufs_to_drop++] = mbuf;
+                    break;
+                }
             }
         }
-    }
-    else
-    {
-        rte_memcpy(mbufs_to_send, objs, cnt * sizeof(void *));
-        nr_mbufs_to_send = cnt;
-    }
+        else
+        {
+            rte_memcpy(mbufs_to_send, pkts, nr_curr_send * sizeof(void *));
+            nr_mbufs_to_send = nr_curr_send;
+        }
 
-    do_tx_burst(graph, node, dev_desc, mbufs_to_send, nr_mbufs_to_send);
+        do_tx_burst(graph, node, dev_desc, mbufs_to_send, nr_mbufs_to_send);
 
-    /* enqueue drop packet to next node */
-    if (nr_mbufs_to_drop > 0)
-    {
-        rte_node_enqueue(graph, node, 0, (void **)mbufs_to_drop, nr_mbufs_to_drop);
+        /* enqueue drop packet to next node */
+        if (nr_mbufs_to_drop > 0)
+        {
+            rte_node_enqueue(graph, node, 0, (void **)mbufs_to_drop, nr_mbufs_to_drop);
+        }
+
+        /* stat */
+        stat_per_core->tx_meter_red += counter_tx_meter_red;
+        stat_per_core->tx_meter_yellow += counter_tx_meter_yellow;
+        stat_per_core->tx_meter_green += counter_tx_meter_green;
+        stat_per_core->total_tx_pkts += nr_mbufs_to_send;
+        stat_per_core->tx_pkts_per_batch = nr_mbufs_to_send;
+        stat_per_core->total_tx_drop_pkts += nr_mbufs_to_drop;
+        pkts += nr_curr_send;
     }
 
-    /* stat */
-    stat_per_core->tx_meter_red += counter_tx_meter_red;
-    stat_per_core->tx_meter_yellow += counter_tx_meter_yellow;
-    stat_per_core->tx_meter_green += counter_tx_meter_green;
-    stat_per_core->total_tx_pkts += nr_mbufs_to_send;
-    stat_per_core->tx_pkts_per_batch = nr_mbufs_to_send;
-    stat_per_core->total_tx_drop_pkts += nr_mbufs_to_drop;
     return cnt;
 }