Fix potential crash in rx and tx distribution

In some (rare) modes, more than 64 packets can be received through
one rx function. This is for instance the case of the lat mode.

Change-Id: Ie733c927a8e116c679c464f2551768185ef85366
Signed-off-by: Xavier Simonart <xavier.simonart@intel.com>

diff --git a/VNFs/DPPD-PROX/rx_pkt.c b/VNFs/DPPD-PROX/rx_pkt.c
index fd0f7e5..f6adeb4 100644 (file)
--- a/VNFs/DPPD-PROX/rx_pkt.c
+++ b/VNFs/DPPD-PROX/rx_pkt.c
@@ -476,7 +476,10 @@ uint16_t rx_pkt_distr(struct task_base *tbase, struct rte_mbuf ***mbufs)
 {
        uint16_t ret = call_prev_rx_pkt(tbase, mbufs);
 
-       tbase->aux->rx_bucket[ret]++;
+       if (likely(ret < RX_BUCKET_SIZE))
+               tbase->aux->rx_bucket[ret]++;
+       else
+               tbase->aux->rx_bucket[RX_BUCKET_SIZE - 1]++;
        return ret;
 }
 

diff --git a/VNFs/DPPD-PROX/task_base.h b/VNFs/DPPD-PROX/task_base.h
index f8c0524..00087ab 100644 (file)
--- a/VNFs/DPPD-PROX/task_base.h
+++ b/VNFs/DPPD-PROX/task_base.h
@@ -143,6 +143,9 @@ struct task_base;
 
 #define MAX_RX_PKT_ALL 16384
 
+#define RX_BUCKET_SIZE (2 * MAX_RING_BURST + 1) /* Limit RX bucket size */
+#define TX_BUCKET_SIZE (MAX_RING_BURST +1)
+
 #define MAX_STACKED_RX_FUCTIONS 16
 
 typedef uint16_t (*rx_pkt_func) (struct task_base *tbase, struct rte_mbuf ***mbufs);
@@ -164,8 +167,8 @@ struct task_base_aux {
        int      rx_prev_idx;
        uint16_t (*rx_pkt_prev[MAX_STACKED_RX_FUCTIONS])(struct task_base *tbase, struct rte_mbuf ***mbufs);
 
-       uint32_t rx_bucket[MAX_RING_BURST + 1];
-       uint32_t tx_bucket[MAX_RING_BURST + 1];
+       uint32_t rx_bucket[RX_BUCKET_SIZE];
+       uint32_t tx_bucket[TX_BUCKET_SIZE];
        int (*tx_pkt_l2)(struct task_base *tbase, struct rte_mbuf **mbufs, const uint16_t n_pkts, uint8_t *out);
        int (*tx_pkt_orig)(struct task_base *tbase, struct rte_mbuf **mbufs, const uint16_t n_pkts, uint8_t *out);
        int (*tx_pkt_hw)(struct task_base *tbase, struct rte_mbuf **mbufs, const uint16_t n_pkts, uint8_t *out);

diff --git a/VNFs/DPPD-PROX/tx_pkt.c b/VNFs/DPPD-PROX/tx_pkt.c
index 9ada51c..49f4689 100644 (file)
--- a/VNFs/DPPD-PROX/tx_pkt.c
+++ b/VNFs/DPPD-PROX/tx_pkt.c
@@ -704,7 +704,10 @@ int tx_pkt_dump(struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkt
    task that xmits the packet, no atomic operation is needed. */
 int tx_pkt_distr(struct task_base *tbase, struct rte_mbuf **mbufs, uint16_t n_pkts, uint8_t *out)
 {
-       tbase->aux->tx_bucket[n_pkts]++;
+       if (likely(n_pkts < TX_BUCKET_SIZE))
+               tbase->aux->tx_bucket[n_pkts]++;
+       else
+               tbase->aux->tx_bucket[TX_BUCKET_SIZE - 1]++;
        return tbase->aux->tx_pkt_orig(tbase, mbufs, n_pkts, out);
 }