Skip to content

fix frame_clone_and_push_hdr: guard stack overflow at the push site#10

Open
jeso-mchp wants to merge 1 commit intomasterfrom
master.fix-frame-stack-overflow-guard
Open

fix frame_clone_and_push_hdr: guard stack overflow at the push site#10
jeso-mchp wants to merge 1 commit intomasterfrom
master.fix-frame-stack-overflow-guard

Conversation

@jeso-mchp
Copy link

Revert the argc > FRAME_STACK_MAX check added in db43211 ("Frame stack size check added") and replace it with a proper guard in frame_clone_and_push_hdr().

Problem

The check in argc_frame() compares argc (total remaining argv) against FRAME_STACK_MAX (the per-frame header stack depth). These are fundamentally different quantities, argc includes arguments for ALL subsequent tx/rx clauses, not just the current frame being parsed.

A single tx clause like tx eth0 eth smac ::1 dmac ::2 consumes 7 argv entries but only pushes 1 header onto the frame stack. With FRAME_STACK_MAX=200, just 29 tx clauses (29 × 7 = 203 args) trip the check even though each individual frame only uses a few stack entries.

This breaks real-world usage. For example, the switchdev test framework's FDB stress test batches 100 tx clauses into a single ef invocation:

smacs.each_slice(100).each do |chunk|
cmd = 'ef'
chunk.each do |smac|
        cmd += " tx #{$pp[1]} eth smac #{smac} dmac #{dmac}"
end
$ts.pc.run cmd
end

This fails due to this argc check bug.

Fix

Remove the argc check from argc_frame() and guard the actual array push in frame_clone_and_push_hdr() where f->stack[] is written.

frame_clone_and_push_hdr() is the only place that writes to f->stack[], so this single guard is sufficient.

Revert the incorrect argc > FRAME_STACK_MAX check added in db43211
argc counts total remaining argv (all subsequent tx/rx clauses), not
per-frame stack entries, so 29+ tx clauses falsely tripped the limit.

Instead, guard the actual array push in frame_clone_and_push_hdr().
@jeso-mchp jeso-mchp requested a review from HoratiuVultur March 3, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant