fix frame_clone_and_push_hdr: guard stack overflow at the push site#10
Open
fix frame_clone_and_push_hdr: guard stack overflow at the push site#10
Conversation
Revert the incorrect argc > FRAME_STACK_MAX check added in db43211 argc counts total remaining argv (all subsequent tx/rx clauses), not per-frame stack entries, so 29+ tx clauses falsely tripped the limit. Instead, guard the actual array push in frame_clone_and_push_hdr().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Revert the argc > FRAME_STACK_MAX check added in db43211 ("Frame stack size check added") and replace it with a proper guard in frame_clone_and_push_hdr().
Problem
The check in argc_frame() compares argc (total remaining argv) against FRAME_STACK_MAX (the per-frame header stack depth). These are fundamentally different quantities, argc includes arguments for ALL subsequent tx/rx clauses, not just the current frame being parsed.
A single tx clause like tx eth0 eth smac ::1 dmac ::2 consumes 7 argv entries but only pushes 1 header onto the frame stack. With FRAME_STACK_MAX=200, just 29 tx clauses (29 × 7 = 203 args) trip the check even though each individual frame only uses a few stack entries.
This breaks real-world usage. For example, the switchdev test framework's FDB stress test batches 100 tx clauses into a single ef invocation:
This fails due to this argc check bug.
Fix
Remove the
argccheck fromargc_frame()and guard the actual array push inframe_clone_and_push_hdr()wheref->stack[]is written.frame_clone_and_push_hdr()is the only place that writes tof->stack[], so this single guard is sufficient.