mirrors/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2025-05-20 00:15:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

packet: ASSERT on signs of pool corruption

Browse source 
If packet_check_range() fails in packet_get_try_do() we just return NULL.
But this check only takes places after we've already validated the given
range against the packet it's in.  That means that if packet_check_range()
fails, the packet pool is already in a corrupted state (we should have
made strictly stronger checks when the packet was added).  Simply returning
NULL and logging a trace() level message isn't really adequate for that
situation; ASSERT instead.

Similarly we check the given idx against both p->count and p->size.  The
latter should be redundant, because count should always be <= size.  If
that's not the case then, again, the pool is already in a corrupted state
and we may have overwritten unknown memory.  Assert for this case too.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
David Gibson 2025-03-17 20:24:23 +11:00 • committed by Stefano Brivio
parent 9153aca15b
commit 0857515c94
1 changed files with 9 additions and 5 deletions

14
packet.c
View file

@ -129,9 +129,13 @@ void *packet_get_try_do(const struct pool *p, size_t idx, size_t offset,
{
char *ptr;
if (idx >= p->size || idx >= p->count) {
trace("packet %zu from pool size: %zu, count: %zu, %s:%i",
idx, p->size, p->count, func, line);
ASSERT_WITH_MSG(p->count <= p->size,
"Corrupt pool count: %zu, size: %zu, %s:%i",
p->count, p->size, func, line);
if (idx >= p->count) {
trace("packet %zu from pool count: %zu, %s:%i",
idx, p->count, func, line);
return NULL;
}
@ -141,8 +145,8 @@ void *packet_get_try_do(const struct pool *p, size_t idx, size_t offset,
ptr = (char *)p->pkt[idx].iov_base + offset;
if (packet_check_range(p, ptr, len, func, line))
return NULL;
ASSERT_WITH_MSG(!packet_check_range(p, ptr, len, func, line),
"Corrupt packet pool, %s:%i", func, line);
if (left)
*left = p->pkt[idx].iov_len - offset - len;