When rte_pcapng_copy() is called with a comment, the option data
may not fit in the mbuf's remaining tailroom, causing the append
to fail and the packet to be dropped.
Fix this by allocating and chaining an additional mbuf segment
when rte_pktmbuf_append() fails. This allows comments of any
length (up to UINT16_MAX) to be attached to captured packets.
Fixes: c1abd1e93dbd ("pcapng: support comment in enhanced packet block")
Cc: [email protected]
Signed-off-by: Stephen Hemminger <[email protected]>
---
lib/pcapng/rte_pcapng.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/lib/pcapng/rte_pcapng.c b/lib/pcapng/rte_pcapng.c
index d5b3a0cd29..b9de51849b 100644
--- a/lib/pcapng/rte_pcapng.c
+++ b/lib/pcapng/rte_pcapng.c
@@ -570,11 +570,26 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
if (comment)
optlen += pcapng_optlen(strlen(comment));
- /* reserve trailing options and block length */
- opt = (struct pcapng_option *)
- rte_pktmbuf_append(mc, optlen + sizeof(uint32_t));
- if (unlikely(opt == NULL))
- goto fail;
+ /*
+ * Try to put options at the end of this mbuf.
+ * If not extend the mbuf by adding another segment.
+ */
+ opt = (struct pcapng_option *)rte_pktmbuf_append(mc, optlen +
sizeof(uint32_t));
+ if (unlikely(opt == NULL)) {
+ struct rte_mbuf *ml = rte_pktmbuf_alloc(mp);
+
+ if (unlikely(ml == NULL))
+ goto fail; /* mbuf pool is empty */
+
+ if (unlikely(rte_pktmbuf_chain(mc, ml) != 0)) {
+ rte_pktmbuf_free(ml);
+ goto fail; /* too many segments in the mbuf */
+ }
+
+ opt = (struct pcapng_option *)rte_pktmbuf_append(mc, optlen +
sizeof(uint32_t));
+ if (unlikely(opt == NULL))
+ goto fail; /* additional segment and still no
space */
+ }
switch (direction) {
case RTE_PCAPNG_DIRECTION_IN:
--
2.51.0
