diff mbox series

[ovs-dev] learning-switch: Fix coredump of OpenFlow15 learning-switch

Message ID 20230329063429.2786585-1-faicker.mo@ucloud.cn
State Superseded
Headers show
Series [ovs-dev] learning-switch: Fix coredump of OpenFlow15 learning-switch | expand

Checks

Context Check Description
ovsrobot/apply-robot success apply and check: success
ovsrobot/github-robot-_Build_and_Test success github build: passed
ovsrobot/intel-ovs-compilation success test: success

Commit Message

Faicker Mo March 29, 2023, 6:34 a.m. UTC
The OpenFlow15 Packet-Out message contains the whole match instead of the in_port.
The match has no assignment but used in oxm_put_match.

The coredump gdb backtrace is:
 #0  memcpy_from_metadata (dst=dst@entry=0x7ffcfac2f060, src=src@entry=0x7ffcfac30880, loc=loc@entry=0x10) at lib/tun-metadata.c:467
 #1  0x00000000004506e8 in metadata_loc_from_match_read (match=0x7ffcfac30598, is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, map=0x0) at lib/tun-metadata.c:865
 #2  metadata_loc_from_match_read (is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, match=0x7ffcfac30598, map=0x0) at lib/tun-metadata.c:854
 #3  tun_metadata_to_nx_match (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598) at lib/tun-metadata.c:888
 #4  0x000000000047c1f8 in nx_put_raw (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598, cookie=<optimized out>, cookie@entry=0,
     cookie_mask=<optimized out>, cookie_mask@entry=0) at lib/nx-match.c:1186
 #5  0x000000000047d693 in oxm_put_match (b=b@entry=0x892260, match=match@entry=0x7ffcfac30598, version=version@entry=OFP15_VERSION) at lib/nx-match.c:1343
 #6  0x000000000043194e in ofputil_encode_packet_out (po=po@entry=0x7ffcfac30580, protocol=<optimized out>) at lib/ofp-packet.c:1226
 #7  0x000000000040a4fe in process_packet_in (sw=sw@entry=0x891d70, oh=<optimized out>) at lib/learning-switch.c:619
 #8  0x000000000040acdc in lswitch_process_packet (msg=0x892210, sw=0x891d70) at lib/learning-switch.c:374
 #9  lswitch_run (sw=0x891d70) at lib/learning-switch.c:324
 #10 0x0000000000406f26 in main (argc=<optimized out>, argv=<optimized out>) at utilities/ovs-testcontroller.c:180

Fix that by setting the packet-out match instead of in_port.

Fixes: 577bfa9f6879 ("ofp-util: Add OpenFlow 1.5 packet-out support")
Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>
---
 lib/learning-switch.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Ilya Maximets March 29, 2023, 7:36 p.m. UTC | #1
On 3/29/23 08:34, Faicker Mo wrote:
> The OpenFlow15 Packet-Out message contains the whole match instead of the in_port.
> The match has no assignment but used in oxm_put_match.
> 
> The coredump gdb backtrace is:
>  #0  memcpy_from_metadata (dst=dst@entry=0x7ffcfac2f060, src=src@entry=0x7ffcfac30880, loc=loc@entry=0x10) at lib/tun-metadata.c:467
>  #1  0x00000000004506e8 in metadata_loc_from_match_read (match=0x7ffcfac30598, is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, map=0x0) at lib/tun-metadata.c:865
>  #2  metadata_loc_from_match_read (is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, match=0x7ffcfac30598, map=0x0) at lib/tun-metadata.c:854
>  #3  tun_metadata_to_nx_match (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598) at lib/tun-metadata.c:888
>  #4  0x000000000047c1f8 in nx_put_raw (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598, cookie=<optimized out>, cookie@entry=0,
>      cookie_mask=<optimized out>, cookie_mask@entry=0) at lib/nx-match.c:1186
>  #5  0x000000000047d693 in oxm_put_match (b=b@entry=0x892260, match=match@entry=0x7ffcfac30598, version=version@entry=OFP15_VERSION) at lib/nx-match.c:1343
>  #6  0x000000000043194e in ofputil_encode_packet_out (po=po@entry=0x7ffcfac30580, protocol=<optimized out>) at lib/ofp-packet.c:1226
>  #7  0x000000000040a4fe in process_packet_in (sw=sw@entry=0x891d70, oh=<optimized out>) at lib/learning-switch.c:619
>  #8  0x000000000040acdc in lswitch_process_packet (msg=0x892210, sw=0x891d70) at lib/learning-switch.c:374
>  #9  lswitch_run (sw=0x891d70) at lib/learning-switch.c:324
>  #10 0x0000000000406f26 in main (argc=<optimized out>, argv=<optimized out>) at utilities/ovs-testcontroller.c:180
> 
> Fix that by setting the packet-out match instead of in_port.
> 
> Fixes: 577bfa9f6879 ("ofp-util: Add OpenFlow 1.5 packet-out support")
> Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>
> ---
>  lib/learning-switch.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/lib/learning-switch.c b/lib/learning-switch.c
> index 8102475ca..b67163aca 100644
> --- a/lib/learning-switch.c
> +++ b/lib/learning-switch.c
> @@ -577,8 +577,7 @@ process_packet_in(struct lswitch *sw, const struct ofp_header *oh)
>          po.packet = NULL;
>          po.packet_len = 0;
>      }
> -    match_set_in_port(&po.flow_metadata,
> -                      pi.flow_metadata.flow.in_port.ofp_port);
> +    flow_get_metadata(&flow, &po.flow_metadata);
>      po.ofpacts = ofpacts.data;
>      po.ofpacts_len = ofpacts.size;
>  

Hi.  Thanks for the patch!
Could you, please, add a unit test that exercises the issue?

Maybe the issue is caused by 'po' being allocated on the stack and
not initialized?  I mean, will zeroing out 'po' fix the problem?

Best regards, Ilya Maximets.
Faicker Mo March 30, 2023, 3:06 a.m. UTC | #2
I'll add a test later.


You are right. Zeroing out the po can fix the problem.


From: Ilya Maximets <i.maximets@ovn.org>
Date: 2023-03-30 03:36:48
To:  Faicker Mo <faicker.mo@ucloud.cn>
Cc:  dev@openvswitch.org,i.maximets@ovn.org
Subject: Re: [ovs-dev] [PATCH] learning-switch: Fix coredump of OpenFlow15 learning-switch>On 3/29/23 08:34, Faicker Mo wrote:
>> The OpenFlow15 Packet-Out message contains the whole match instead of the in_port.
>> The match has no assignment but used in oxm_put_match.
>> 
>> The coredump gdb backtrace is:
>>  #0  memcpy_from_metadata (dst=dst@entry=0x7ffcfac2f060, src=src@entry=0x7ffcfac30880, loc=loc@entry=0x10) at lib/tun-metadata.c:467
>>  #1  0x00000000004506e8 in metadata_loc_from_match_read (match=0x7ffcfac30598, is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, map=0x0) at lib/tun-metadata.c:865
>>  #2  metadata_loc_from_match_read (is_masked=<synthetic pointer>, mask=0x7ffcfac30838, idx=0, match=0x7ffcfac30598, map=0x0) at lib/tun-metadata.c:854
>>  #3  tun_metadata_to_nx_match (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598) at lib/tun-metadata.c:888
>>  #4  0x000000000047c1f8 in nx_put_raw (b=b@entry=0x892260, oxm=oxm@entry=OFP15_VERSION, match=match@entry=0x7ffcfac30598, cookie=<optimized out>, cookie@entry=0,
>>      cookie_mask=<optimized out>, cookie_mask@entry=0) at lib/nx-match.c:1186
>>  #5  0x000000000047d693 in oxm_put_match (b=b@entry=0x892260, match=match@entry=0x7ffcfac30598, version=version@entry=OFP15_VERSION) at lib/nx-match.c:1343
>>  #6  0x000000000043194e in ofputil_encode_packet_out (po=po@entry=0x7ffcfac30580, protocol=<optimized out>) at lib/ofp-packet.c:1226
>>  #7  0x000000000040a4fe in process_packet_in (sw=sw@entry=0x891d70, oh=<optimized out>) at lib/learning-switch.c:619
>>  #8  0x000000000040acdc in lswitch_process_packet (msg=0x892210, sw=0x891d70) at lib/learning-switch.c:374
>>  #9  lswitch_run (sw=0x891d70) at lib/learning-switch.c:324
>>  #10 0x0000000000406f26 in main (argc=<optimized out>, argv=<optimized out>) at utilities/ovs-testcontroller.c:180
>> 
>> Fix that by setting the packet-out match instead of in_port.
>> 
>> Fixes: 577bfa9f6879 ("ofp-util: Add OpenFlow 1.5 packet-out support")
>> Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>
>> ---
>>  lib/learning-switch.c | 3 +--
>>  1 file changed, 1 insertion(+), 2 deletions(-)
>> 
>> diff --git a/lib/learning-switch.c b/lib/learning-switch.c
>> index 8102475ca..b67163aca 100644
>> --- a/lib/learning-switch.c
>> +++ b/lib/learning-switch.c
>> @@ -577,8 +577,7 @@ process_packet_in(struct lswitch *sw, const struct ofp_header *oh)
>>          po.packet = NULL;
>>          po.packet_len = 0;
>>      }
>> -    match_set_in_port(&po.flow_metadata,
>> -                      pi.flow_metadata.flow.in_port.ofp_port);
>> +    flow_get_metadata(&flow, &po.flow_metadata);
>>      po.ofpacts = ofpacts.data;
>>      po.ofpacts_len = ofpacts.size;
>>  
>
>Hi.  Thanks for the patch!
>Could you, please, add a unit test that exercises the issue?
>
>Maybe the issue is caused by 'po' being allocated on the stack and
>not initialized?  I mean, will zeroing out 'po' fix the problem?
>
>Best regards, Ilya Maximets.
diff mbox series

Patch

diff --git a/lib/learning-switch.c b/lib/learning-switch.c
index 8102475ca..b67163aca 100644
--- a/lib/learning-switch.c
+++ b/lib/learning-switch.c
@@ -577,8 +577,7 @@  process_packet_in(struct lswitch *sw, const struct ofp_header *oh)
         po.packet = NULL;
         po.packet_len = 0;
     }
-    match_set_in_port(&po.flow_metadata,
-                      pi.flow_metadata.flow.in_port.ofp_port);
+    flow_get_metadata(&flow, &po.flow_metadata);
     po.ofpacts = ofpacts.data;
     po.ofpacts_len = ofpacts.size;