diff mbox series

[ovs-dev] datapath-windows: Fix invalid reference in Buffermgmt.c

Message ID 20181114200728.203108-1-vsairam@vmware.com
State Accepted
Delegated to: Alin Gabriel Serdean
Headers show
Series [ovs-dev] datapath-windows: Fix invalid reference in Buffermgmt.c | expand

Commit Message

Sairam Venugopal Nov. 14, 2018, 8:07 p.m. UTC 
OVS_BUFFER_CONTEXT gets cleared as part of NdisFreeNetBufferListContext
function call. This causes an invalid reference error.

Found while testing with driver verifier enabled.

Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
---
 datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Anand Kumar Nov. 14, 2018, 8:41 p.m. UTC | #1 
Acked-by: Anand Kumar <kumaranand@vmware.com>

On 11/14/18, 12:08 PM, "ovs-dev-bounces@openvswitch.org on behalf of Sairam Venugopal" <ovs-dev-bounces@openvswitch.org on behalf of vsairam@vmware.com> wrote:

    OVS_BUFFER_CONTEXT gets cleared as part of NdisFreeNetBufferListContext
    function call. This causes an invalid reference error.
    
    Found while testing with driver verifier enabled.
    
    Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
    ---
     datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
     1 file changed, 4 insertions(+), 2 deletions(-)
    
    diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-windows/ovsext/BufferMgmt.c
    index 448cd76..da5c04a 100644
    --- a/datapath-windows/ovsext/BufferMgmt.c
    +++ b/datapath-windows/ovsext/BufferMgmt.c
    @@ -1622,6 +1622,7 @@ OvsCompleteNBL(PVOID switch_ctx,
     {
         POVS_BUFFER_CONTEXT ctx;
         UINT16 flags;
    +    UINT32 dataOffsetDelta;
         PNET_BUFFER_LIST parent;
         NDIS_STATUS status;
         NDIS_HANDLE poolHandle;
    @@ -1653,6 +1654,7 @@ OvsCompleteNBL(PVOID switch_ctx,
         nb = NET_BUFFER_LIST_FIRST_NB(nbl);
     
         flags = ctx->flags;
    +    dataOffsetDelta = ctx->dataOffsetDelta;
         if (!(flags & OVS_BUFFER_FRAGMENT) &&
             NET_BUFFER_DATA_LENGTH(nb) != ctx->origDataLength) {
             UINT32 diff;
    @@ -1667,7 +1669,7 @@ OvsCompleteNBL(PVOID switch_ctx,
             }
         }
     
    -    if (ctx->flags & OVS_BUFFER_PRIVATE_CONTEXT) {
    +    if (flags & OVS_BUFFER_PRIVATE_CONTEXT) {
             NdisFreeNetBufferListContext(nbl, sizeof (OVS_BUFFER_CONTEXT));
         }
     
    @@ -1740,7 +1742,7 @@ OvsCompleteNBL(PVOID switch_ctx,
     #ifdef DBG
             InterlockedDecrement((LONG volatile *)&ovsPool->fragNBLCount);
     #endif
    -        NdisFreeFragmentNetBufferList(nbl, ctx->dataOffsetDelta, 0);
    +        NdisFreeFragmentNetBufferList(nbl, dataOffsetDelta, 0);
         }
     
         if (parent != NULL) {
    -- 
    2.9.0.windows.1
    
    _______________________________________________
    dev mailing list
    dev@openvswitch.org
    https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fmailman%2Flistinfo%2Fovs-dev&amp;data=02%7C01%7Ckumaranand%40vmware.com%7Ca76b63e45f744f0e4f2608d64a6ce69a%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636778228925636177&amp;sdata=M7AXSs2W86omaePmkDRSpGZDyX0723r88JJw4NfK%2BNU%3D&amp;reserved=0
Alin-Gabriel Serdean Nov. 15, 2018, 2:52 p.m. UTC | #2 
Thanks for the fix!

Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>

> -----Mesaj original-----
> De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
> bounces@openvswitch.org> În numele Sairam Venugopal
> Trimis: Wednesday, November 14, 2018 10:07 PM
> Către: dev@openvswitch.org
> Subiect: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
> Buffermgmt.c
> 
> OVS_BUFFER_CONTEXT gets cleared as part of
> NdisFreeNetBufferListContext function call. This causes an invalid
reference
> error.
> 
> Found while testing with driver verifier enabled.
> 
> Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
> ---
>  datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-
> windows/ovsext/BufferMgmt.c
> index 448cd76..da5c04a 100644
> --- a/datapath-windows/ovsext/BufferMgmt.c
> +++ b/datapath-windows/ovsext/BufferMgmt.c
Alin Serdean Nov. 15, 2018, 3:02 p.m. UTC | #3 
I applied the patch on master and as far as it goes without conflicts.

--
Alin.

> -----Mesaj original-----
> De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
> bounces@openvswitch.org> În numele aserdean@ovn.org
> Trimis: Thursday, November 15, 2018 4:52 PM
> Către: 'Sairam Venugopal' <vsairam@vmware.com>; dev@openvswitch.org
> Subiect: Re: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
> Buffermgmt.c
> 
> Thanks for the fix!
> 
> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
> 
> > -----Mesaj original-----
> > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
> > bounces@openvswitch.org> În numele Sairam Venugopal
> > Trimis: Wednesday, November 14, 2018 10:07 PM
> > Către: dev@openvswitch.org
> > Subiect: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
> > Buffermgmt.c
> >
> > OVS_BUFFER_CONTEXT gets cleared as part of
> > NdisFreeNetBufferListContext function call. This causes an invalid
> reference
> > error.
> >
> > Found while testing with driver verifier enabled.
> >
> > Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
> > ---
> >  datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-
> > windows/ovsext/BufferMgmt.c index 448cd76..da5c04a 100644
> > --- a/datapath-windows/ovsext/BufferMgmt.c
> > +++ b/datapath-windows/ovsext/BufferMgmt.c
> 
> _______________________________________________
> dev mailing list
> dev@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Sairam Venugopal Nov. 15, 2018, 6:40 p.m. UTC | #4 
Is it too late to backport this to 2.10?

On 11/15/18, 7:03 AM, "Alin Serdean" <aserdean@cloudbasesolutions.com> wrote:

    I applied the patch on master and as far as it goes without conflicts.
    
    --
    Alin.
    
    > -----Mesaj original-----
    > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
    > bounces@openvswitch.org> În numele aserdean@ovn.org
    > Trimis: Thursday, November 15, 2018 4:52 PM
    > Către: 'Sairam Venugopal' <vsairam@vmware.com>; dev@openvswitch.org
    > Subiect: Re: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
    > Buffermgmt.c
    > 
    > Thanks for the fix!
    > 
    > Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
    > 
    > > -----Mesaj original-----
    > > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
    > > bounces@openvswitch.org> În numele Sairam Venugopal
    > > Trimis: Wednesday, November 14, 2018 10:07 PM
    > > Către: dev@openvswitch.org
    > > Subiect: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
    > > Buffermgmt.c
    > >
    > > OVS_BUFFER_CONTEXT gets cleared as part of
    > > NdisFreeNetBufferListContext function call. This causes an invalid
    > reference
    > > error.
    > >
    > > Found while testing with driver verifier enabled.
    > >
    > > Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
    > > ---
    > >  datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
    > >  1 file changed, 4 insertions(+), 2 deletions(-)
    > >
    > > diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-
    > > windows/ovsext/BufferMgmt.c index 448cd76..da5c04a 100644
    > > --- a/datapath-windows/ovsext/BufferMgmt.c
    > > +++ b/datapath-windows/ovsext/BufferMgmt.c
    > 
    > _______________________________________________
    > dev mailing list
    > dev@openvswitch.org
    > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fmailman%2Flistinfo%2Fovs-dev&amp;data=02%7C01%7Cvsairam%40vmware.com%7Ccb97b47b8b964d81494708d64b0b6ce3%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636778909792412676&amp;sdata=DRZ%2FcHxQoIhqwjl2WZbHNOOI89jwASyJat7oY0qwoD8%3D&amp;reserved=0
Ben Pfaff Nov. 15, 2018, 6:45 p.m. UTC | #5 
Alin already did that.

On Thu, Nov 15, 2018 at 06:40:00PM +0000, Sairam Venugopal wrote:
> Is it too late to backport this to 2.10?
> 
> On 11/15/18, 7:03 AM, "Alin Serdean" <aserdean@cloudbasesolutions.com> wrote:
> 
>     I applied the patch on master and as far as it goes without conflicts.
>     
>     --
>     Alin.
>     
>     > -----Mesaj original-----
>     > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
>     > bounces@openvswitch.org> În numele aserdean@ovn.org
>     > Trimis: Thursday, November 15, 2018 4:52 PM
>     > Către: 'Sairam Venugopal' <vsairam@vmware.com>; dev@openvswitch.org
>     > Subiect: Re: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
>     > Buffermgmt.c
>     > 
>     > Thanks for the fix!
>     > 
>     > Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
>     > 
>     > > -----Mesaj original-----
>     > > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
>     > > bounces@openvswitch.org> În numele Sairam Venugopal
>     > > Trimis: Wednesday, November 14, 2018 10:07 PM
>     > > Către: dev@openvswitch.org
>     > > Subiect: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
>     > > Buffermgmt.c
>     > >
>     > > OVS_BUFFER_CONTEXT gets cleared as part of
>     > > NdisFreeNetBufferListContext function call. This causes an invalid
>     > reference
>     > > error.
>     > >
>     > > Found while testing with driver verifier enabled.
>     > >
>     > > Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
>     > > ---
>     > >  datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
>     > >  1 file changed, 4 insertions(+), 2 deletions(-)
>     > >
>     > > diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-
>     > > windows/ovsext/BufferMgmt.c index 448cd76..da5c04a 100644
>     > > --- a/datapath-windows/ovsext/BufferMgmt.c
>     > > +++ b/datapath-windows/ovsext/BufferMgmt.c
>     > 
>     > _______________________________________________
>     > dev mailing list
>     > dev@openvswitch.org
>     > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fmailman%2Flistinfo%2Fovs-dev&amp;data=02%7C01%7Cvsairam%40vmware.com%7Ccb97b47b8b964d81494708d64b0b6ce3%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636778909792412676&amp;sdata=DRZ%2FcHxQoIhqwjl2WZbHNOOI89jwASyJat7oY0qwoD8%3D&amp;reserved=0
>     
> 
> _______________________________________________
> dev mailing list
> dev@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Sairam Venugopal Nov. 15, 2018, 6:47 p.m. UTC | #6 
Thanks!

On 11/15/18, 10:45 AM, "Ben Pfaff" <blp@ovn.org> wrote:

    Alin already did that.
    
    On Thu, Nov 15, 2018 at 06:40:00PM +0000, Sairam Venugopal wrote:
    > Is it too late to backport this to 2.10?
    > 
    > On 11/15/18, 7:03 AM, "Alin Serdean" <aserdean@cloudbasesolutions.com> wrote:
    > 
    >     I applied the patch on master and as far as it goes without conflicts.
    >     
    >     --
    >     Alin.
    >     
    >     > -----Mesaj original-----
    >     > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
    >     > bounces@openvswitch.org> În numele aserdean@ovn.org
    >     > Trimis: Thursday, November 15, 2018 4:52 PM
    >     > Către: 'Sairam Venugopal' <vsairam@vmware.com>; dev@openvswitch.org
    >     > Subiect: Re: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
    >     > Buffermgmt.c
    >     > 
    >     > Thanks for the fix!
    >     > 
    >     > Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
    >     > 
    >     > > -----Mesaj original-----
    >     > > De la: ovs-dev-bounces@openvswitch.org <ovs-dev-
    >     > > bounces@openvswitch.org> În numele Sairam Venugopal
    >     > > Trimis: Wednesday, November 14, 2018 10:07 PM
    >     > > Către: dev@openvswitch.org
    >     > > Subiect: [ovs-dev] [PATCH] datapath-windows: Fix invalid reference in
    >     > > Buffermgmt.c
    >     > >
    >     > > OVS_BUFFER_CONTEXT gets cleared as part of
    >     > > NdisFreeNetBufferListContext function call. This causes an invalid
    >     > reference
    >     > > error.
    >     > >
    >     > > Found while testing with driver verifier enabled.
    >     > >
    >     > > Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
    >     > > ---
    >     > >  datapath-windows/ovsext/BufferMgmt.c | 6 ++++--
    >     > >  1 file changed, 4 insertions(+), 2 deletions(-)
    >     > >
    >     > > diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-
    >     > > windows/ovsext/BufferMgmt.c index 448cd76..da5c04a 100644
    >     > > --- a/datapath-windows/ovsext/BufferMgmt.c
    >     > > +++ b/datapath-windows/ovsext/BufferMgmt.c
    >     > 
    >     > _______________________________________________
    >     > dev mailing list
    >     > dev@openvswitch.org
    >     > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fmailman%2Flistinfo%2Fovs-dev&amp;data=02%7C01%7Cvsairam%40vmware.com%7C0354cc7dee7d477cb53108d64b2a7f97%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636779043242021462&amp;sdata=mvAm5BLoz21%2FNhURhoFdj%2FwZY4VcDHzfQx6UMxOh99c%3D&amp;reserved=0
    >     
    > 
    > _______________________________________________
    > dev mailing list
    > dev@openvswitch.org
    > https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmail.openvswitch.org%2Fmailman%2Flistinfo%2Fovs-dev&amp;data=02%7C01%7Cvsairam%40vmware.com%7C0354cc7dee7d477cb53108d64b2a7f97%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636779043242021462&amp;sdata=mvAm5BLoz21%2FNhURhoFdj%2FwZY4VcDHzfQx6UMxOh99c%3D&amp;reserved=0
diff mbox series

Patch

diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-windows/ovsext/BufferMgmt.c
index 448cd76..da5c04a 100644
--- a/datapath-windows/ovsext/BufferMgmt.c
+++ b/datapath-windows/ovsext/BufferMgmt.c
@@ -1622,6 +1622,7 @@  OvsCompleteNBL(PVOID switch_ctx,
 {
     POVS_BUFFER_CONTEXT ctx;
     UINT16 flags;
+    UINT32 dataOffsetDelta;
     PNET_BUFFER_LIST parent;
     NDIS_STATUS status;
     NDIS_HANDLE poolHandle;
@@ -1653,6 +1654,7 @@  OvsCompleteNBL(PVOID switch_ctx,
     nb = NET_BUFFER_LIST_FIRST_NB(nbl);
 
     flags = ctx->flags;
+    dataOffsetDelta = ctx->dataOffsetDelta;
     if (!(flags & OVS_BUFFER_FRAGMENT) &&
         NET_BUFFER_DATA_LENGTH(nb) != ctx->origDataLength) {
         UINT32 diff;
@@ -1667,7 +1669,7 @@  OvsCompleteNBL(PVOID switch_ctx,
         }
     }
 
-    if (ctx->flags & OVS_BUFFER_PRIVATE_CONTEXT) {
+    if (flags & OVS_BUFFER_PRIVATE_CONTEXT) {
         NdisFreeNetBufferListContext(nbl, sizeof (OVS_BUFFER_CONTEXT));
     }
 
@@ -1740,7 +1742,7 @@  OvsCompleteNBL(PVOID switch_ctx,
 #ifdef DBG
         InterlockedDecrement((LONG volatile *)&ovsPool->fragNBLCount);
 #endif
-        NdisFreeFragmentNetBufferList(nbl, ctx->dataOffsetDelta, 0);
+        NdisFreeFragmentNetBufferList(nbl, dataOffsetDelta, 0);
     }
 
     if (parent != NULL) {