diff mbox

[ovs-dev] datapath: compat: vxlan: Avoid possible NULL dereference in vxlan_gro_receive.

Message ID CAJrKr6BBLn9070kjLXj2Y7PTRkh-Dg_1o0v-Z4q5fouDUUzSHA@mail.gmail.com
State Accepted
Headers show

Commit Message

张东亚 Nov. 14, 2016, 2:59 a.m. UTC
With Linux kernel that does not have HAVE_UDP_OFFLOAD_ARG_UOFF macro
detected,
struct vxlan_sock *vs will be NULL, which will make kernel crash when
receiving
VXLAN packet that have RCO flag turn on or even invalid packet that is
destined
to VXLAN port which have the bit on in the RCO flag position.

Signed-off-by: Zhang Dongya <fortitude.zhang@gmail.com>
---
 datapath/linux/compat/vxlan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

        !!(vs->flags &

Comments

Pravin Shelar Nov. 14, 2016, 4:49 a.m. UTC | #1
On Sun, Nov 13, 2016 at 6:59 PM, 张东亚 <fortitude.zhang@gmail.com> wrote:
> With Linux kernel that does not have HAVE_UDP_OFFLOAD_ARG_UOFF macro
> detected,
> struct vxlan_sock *vs will be NULL, which will make kernel crash when
> receiving
> VXLAN packet that have RCO flag turn on or even invalid packet that is
> destined
> to VXLAN port which have the bit on in the RCO flag position.
>
> Signed-off-by: Zhang Dongya <fortitude.zhang@gmail.com>
> ---
>  datapath/linux/compat/vxlan.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/datapath/linux/compat/vxlan.c b/datapath/linux/compat/vxlan.c
> index d5dbe8d..3abcab1 100644
> --- a/datapath/linux/compat/vxlan.c
> +++ b/datapath/linux/compat/vxlan.c
> @@ -320,7 +320,7 @@ static struct sk_buff **vxlan_gro_receive(struct
> sk_buff **head,
>
>   flags = vh->vx_flags;
>
> - if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
> + if ((flags & VXLAN_HF_RCO) && vs && (vs->flags & VXLAN_F_REMCSUM_RX)) {
>   vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
>         vh->vx_vni, &grc,
>         !!(vs->flags &
> --

I could not apply this patch due to white space error. But it is
trivial patch so I manually applied it to master and branch-2.6.
张东亚 Nov. 14, 2016, 5:42 a.m. UTC | #2
Hi,

Maybe it's caused by I manually copy patch to web gmail, thanks a lot for
merging that.


2016-11-14 12:49 GMT+08:00 Pravin Shelar <pshelar@ovn.org>:

> On Sun, Nov 13, 2016 at 6:59 PM, 张东亚 <fortitude.zhang@gmail.com> wrote:
> > With Linux kernel that does not have HAVE_UDP_OFFLOAD_ARG_UOFF macro
> > detected,
> > struct vxlan_sock *vs will be NULL, which will make kernel crash when
> > receiving
> > VXLAN packet that have RCO flag turn on or even invalid packet that is
> > destined
> > to VXLAN port which have the bit on in the RCO flag position.
> >
> > Signed-off-by: Zhang Dongya <fortitude.zhang@gmail.com>
> > ---
> >  datapath/linux/compat/vxlan.c |    2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/datapath/linux/compat/vxlan.c
> b/datapath/linux/compat/vxlan.c
> > index d5dbe8d..3abcab1 100644
> > --- a/datapath/linux/compat/vxlan.c
> > +++ b/datapath/linux/compat/vxlan.c
> > @@ -320,7 +320,7 @@ static struct sk_buff **vxlan_gro_receive(struct
> > sk_buff **head,
> >
> >   flags = vh->vx_flags;
> >
> > - if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
> > + if ((flags & VXLAN_HF_RCO) && vs && (vs->flags & VXLAN_F_REMCSUM_RX)) {
> >   vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
> >         vh->vx_vni, &grc,
> >         !!(vs->flags &
> > --
>
> I could not apply this patch due to white space error. But it is
> trivial patch so I manually applied it to master and branch-2.6.
>
Joe Stringer Nov. 17, 2016, 9:43 p.m. UTC | #3
On 13 November 2016 at 21:42, 张东亚 <fortitude.zhang@gmail.com> wrote:
> Hi,
>
> Maybe it's caused by I manually copy patch to web gmail, thanks a lot for
> merging that.

For what it's worth, git-send-email(1) can be configured to use gmail
for sending/receiving patches and will make sure that the patches
arrive to the list in the right format.
diff mbox

Patch

diff --git a/datapath/linux/compat/vxlan.c b/datapath/linux/compat/vxlan.c
index d5dbe8d..3abcab1 100644
--- a/datapath/linux/compat/vxlan.c
+++ b/datapath/linux/compat/vxlan.c
@@ -320,7 +320,7 @@  static struct sk_buff **vxlan_gro_receive(struct
sk_buff **head,

  flags = vh->vx_flags;

- if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
+ if ((flags & VXLAN_HF_RCO) && vs && (vs->flags & VXLAN_F_REMCSUM_RX)) {
  vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
        vh->vx_vni, &grc,