[ovs-dev] [PATCH] ipf: bail out when ipf state is COMPLETED
Darrell Ball
dlu998 at gmail.com
Thu Nov 14 15:38:55 UTC 2019
Hi RongQing/Wang
On Thu, Nov 14, 2019 at 1:26 AM Li RongQing <lirongqing at baidu.com> wrote:
> it is easy to crash ovs when a packet with same id
> hits a list that already reassembled completedly
> but have not been sent out yet, and this packet is
> not duplicate with this hit ipf list due to bigger
> offset
>
> 1 0x00007f9fef0ae2d9 in __GI_abort () at abort.c:89
>
Good DOS test.
Fix is correct.
This needs a 'Fixes' tag.
Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
This will need to be backported to 2.10.
Thanks Darrell
2 0x0000000000464042 in ipf_list_state_transition at lib/ipf.c:545
>
> Co-authored-by: Wang Li <wangli39 at baidu.com>
> Signed-off-by: Wang Li <wangli39 at baidu.com>
> Signed-off-by: Li RongQing <lirongqing at baidu.com>
> ---
> lib/ipf.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/lib/ipf.c b/lib/ipf.c
> index 4cc0f2df6..45c489122 100644
> --- a/lib/ipf.c
> +++ b/lib/ipf.c
> @@ -899,7 +899,8 @@ ipf_handle_frag(struct ipf *ipf, struct dp_packet
> *pkt, ovs_be16 dl_type,
> MIN(max_frag_list_size,
> IPF_FRAG_LIST_MIN_INCREMENT));
> hmap_insert(&ipf->frag_lists, &ipf_list->node, hash);
> ipf_expiry_list_add(&ipf->frag_exp_list, ipf_list, now);
> - } else if (ipf_list->state == IPF_LIST_STATE_REASS_FAIL) {
> + } else if (ipf_list->state == IPF_LIST_STATE_REASS_FAIL ||
> + ipf_list->state == IPF_LIST_STATE_COMPLETED) {
> /* Bail out as early as possible. */
> return false;
> } else if (ipf_list->last_inuse_idx + 1 >= ipf_list->size) {
> --
> 2.16.2
>
> _______________________________________________
> dev mailing list
> dev at openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
>
More information about the dev
mailing list