[ovs-git] [openvswitch/ovs] 0c3057: ipf: bail out when ipf state is COMPLETED

[lrq-max]

  Branch: refs/heads/master
  Home:   https://github.com/openvswitch/ovs
  Commit: 0c3057d595732cdd3bed7cf2ffb735b53199d780
      https://github.com/openvswitch/ovs/commit/0c3057d595732cdd3bed7cf2ffb735b53199d780
  Author: Li RongQing <lirongqing at baidu.com>
  Date:   2019-11-21 (Thu, 21 Nov 2019)

  Changed paths:
    M lib/ipf.c

  Log Message:
  -----------
  ipf: bail out when ipf state is COMPLETED

it is easy to crash ovs when a packet with same id
hits a list that already reassembled completedly
but have not been sent out yet, and this packet is
not duplicate with this hit ipf list due to bigger
offset

    1  0x00007f9fef0ae2d9 in __GI_abort () at abort.c:89
    2  0x0000000000464042 in ipf_list_state_transition at lib/ipf.c:545

Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
Co-authored-by: Wang Li <wangli39 at baidu.com>
Signed-off-by: Wang Li <wangli39 at baidu.com>
Signed-off-by: Li RongQing <lirongqing at baidu.com>
Signed-off-by: Ben Pfaff <blp at ovn.org>