Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/47814/?format=api
{ "id": 47814, "url": "https://patches.dpdk.org/api/patches/47814/?format=api", "web_url": "https://patches.dpdk.org/project/dpdk/patch/1541420338-300-2-git-send-email-konstantin.ananyev@intel.com/", "project": { "id": 1, "url": "https://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<1541420338-300-2-git-send-email-konstantin.ananyev@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/1541420338-300-2-git-send-email-konstantin.ananyev@intel.com", "date": "2018-11-05T12:18:57", "name": "[v2,1/2] ip_frag: check fragment length of incoming packet", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "bbd30f99293aaa8881cc4bde80628635b19e1612", "submitter": { "id": 33, "url": "https://patches.dpdk.org/api/people/33/?format=api", "name": "Ananyev, Konstantin", "email": "konstantin.ananyev@intel.com" }, "delegate": { "id": 1, "url": "https://patches.dpdk.org/api/users/1/?format=api", "username": "tmonjalo", "first_name": "Thomas", "last_name": "Monjalon", "email": "thomas@monjalon.net" }, "mbox": "https://patches.dpdk.org/project/dpdk/patch/1541420338-300-2-git-send-email-konstantin.ananyev@intel.com/mbox/", "series": [ { "id": 2256, "url": "https://patches.dpdk.org/api/series/2256/?format=api", "web_url": "https://patches.dpdk.org/project/dpdk/list/?series=2256", "date": "2018-11-05T12:18:57", "name": "[v2,1/2] ip_frag: check fragment length of incoming packet", "version": 2, "mbox": "https://patches.dpdk.org/series/2256/mbox/" } ], "comments": "https://patches.dpdk.org/api/patches/47814/comments/", "check": "success", "checks": "https://patches.dpdk.org/api/patches/47814/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@dpdk.org", "Delivered-To": "patchwork@dpdk.org", "Received": [ "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 0F6A75323;\n\tMon, 5 Nov 2018 13:19:08 +0100 (CET)", "from mga01.intel.com (mga01.intel.com [192.55.52.88])\n\tby dpdk.org (Postfix) with ESMTP id 7CE3B31FC;\n\tMon, 5 Nov 2018 13:19:05 +0100 (CET)", "from fmsmga004.fm.intel.com ([10.253.24.48])\n\tby fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;\n\t05 Nov 2018 04:19:04 -0800", "from sivswdev02.ir.intel.com (HELO localhost.localdomain)\n\t([10.237.217.46])\n\tby fmsmga004.fm.intel.com with ESMTP; 05 Nov 2018 04:19:03 -0800" ], "X-Amp-Result": "SKIPPED(no attachment in message)", "X-Amp-File-Uploaded": "False", "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.54,467,1534834800\"; d=\"scan'208\";a=\"103510354\"", "From": "Konstantin Ananyev <konstantin.ananyev@intel.com>", "To": "dev@dpdk.org", "Cc": "stable@dpdk.org, ryan.e.hall@intel.com, alexander.v.gutkin@intel.com,\n\tKonstantin Ananyev <konstantin.ananyev@intel.com>", "Date": "Mon, 5 Nov 2018 12:18:57 +0000", "Message-Id": "<1541420338-300-2-git-send-email-konstantin.ananyev@intel.com>", "X-Mailer": "git-send-email 1.7.0.7", "In-Reply-To": "<1541413603-4792-1-git-send-email-konstantin.ananyev@intel.com>", "References": "<1541413603-4792-1-git-send-email-konstantin.ananyev@intel.com>", "Subject": "[dpdk-dev] [PATCH v2 1/2] ip_frag: check fragment length of\n\tincoming packet", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "Under some conditions ill-formed fragments might cause\nreassembly code to corrupt mbufs and/or crash.\nLet say the following fragments sequence:\n<ofs=0,len=100, flags=MF>\n<ofs=96,len=100, flags=MF>\n<ofs=200,len=0,flags=MF>\n<ofs=200,len=100,flags=0>\ncan trigger the problem.\nTo overcome such situation, added check that fragment length\nof incoming value is greater than zero.\n\nFixes: 601e279df074 (\"ip_frag: move fragmentation/reassembly headers into a library\")\nFixes: 4f1a8f633862 (\"ip_frag: add IPv6 reassembly\")\nCc: stable@dpdk.org\n\nReported-by: Ryan E Hall <ryan.e.hall@intel.com>\nReported-by: Alexander V Gutkin <alexander.v.gutkin@intel.com>\nSigned-off-by: Konstantin Ananyev <konstantin.ananyev@intel.com>\n---\n lib/librte_ip_frag/rte_ipv4_reassembly.c | 22 +++++++++++++------\n lib/librte_ip_frag/rte_ipv6_reassembly.c | 28 +++++++++++++++++-------\n 2 files changed, 35 insertions(+), 15 deletions(-)", "diff": "diff --git a/lib/librte_ip_frag/rte_ipv4_reassembly.c b/lib/librte_ip_frag/rte_ipv4_reassembly.c\nindex 4956b99ea..1029b7abc 100644\n--- a/lib/librte_ip_frag/rte_ipv4_reassembly.c\n+++ b/lib/librte_ip_frag/rte_ipv4_reassembly.c\n@@ -36,8 +36,11 @@ ipv4_frag_reassemble(struct ip_frag_pkt *fp)\n \t\t\t/* previous fragment found. */\n \t\t\tif(fp->frags[i].ofs + fp->frags[i].len == ofs) {\n \n+\t\t\t\tRTE_ASSERT(curr_idx != i);\n+\n \t\t\t\t/* adjust start of the last fragment data. */\n-\t\t\t\trte_pktmbuf_adj(m, (uint16_t)(m->l2_len + m->l3_len));\n+\t\t\t\trte_pktmbuf_adj(m,\n+\t\t\t\t\t(uint16_t)(m->l2_len + m->l3_len));\n \t\t\t\trte_pktmbuf_chain(fp->frags[i].mb, m);\n \n \t\t\t\t/* this mbuf should not be accessed directly */\n@@ -96,14 +99,14 @@ ipv4_frag_reassemble(struct ip_frag_pkt *fp)\n */\n struct rte_mbuf *\n rte_ipv4_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n-\t\tstruct rte_ip_frag_death_row *dr, struct rte_mbuf *mb, uint64_t tms,\n-\t\tstruct ipv4_hdr *ip_hdr)\n+\tstruct rte_ip_frag_death_row *dr, struct rte_mbuf *mb, uint64_t tms,\n+\tstruct ipv4_hdr *ip_hdr)\n {\n \tstruct ip_frag_pkt *fp;\n \tstruct ip_frag_key key;\n \tconst unaligned_uint64_t *psd;\n-\tuint16_t ip_len;\n \tuint16_t flag_offset, ip_ofs, ip_flag;\n+\tint32_t ip_len;\n \n \tflag_offset = rte_be_to_cpu_16(ip_hdr->fragment_offset);\n \tip_ofs = (uint16_t)(flag_offset & IPV4_HDR_OFFSET_MASK);\n@@ -116,12 +119,11 @@ rte_ipv4_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n \tkey.key_len = IPV4_KEYLEN;\n \n \tip_ofs *= IPV4_HDR_OFFSET_UNITS;\n-\tip_len = (uint16_t)(rte_be_to_cpu_16(ip_hdr->total_length) -\n-\t\tmb->l3_len);\n+\tip_len = rte_be_to_cpu_16(ip_hdr->total_length) - mb->l3_len;\n \n \tIP_FRAG_LOG(DEBUG, \"%s:%d:\\n\"\n \t\t\"mbuf: %p, tms: %\" PRIu64\n-\t\t\", key: <%\" PRIx64 \", %#x>, ofs: %u, len: %u, flags: %#x\\n\"\n+\t\t\", key: <%\" PRIx64 \", %#x>, ofs: %u, len: %d, flags: %#x\\n\"\n \t\t\"tbl: %p, max_cycles: %\" PRIu64 \", entry_mask: %#x, \"\n \t\t\"max_entries: %u, use_entries: %u\\n\\n\",\n \t\t__func__, __LINE__,\n@@ -129,6 +131,12 @@ rte_ipv4_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n \t\ttbl, tbl->max_cycles, tbl->entry_mask, tbl->max_entries,\n \t\ttbl->use_entries);\n \n+\t/* check that fragment length is greater then zero. */\n+\tif (ip_len <= 0) {\n+\t\tIP_FRAG_MBUF2DR(dr, mb);\n+\t\treturn NULL;\n+\t}\n+\n \t/* try to find/add entry into the fragment's table. */\n \tif ((fp = ip_frag_find(tbl, dr, &key, tms)) == NULL) {\n \t\tIP_FRAG_MBUF2DR(dr, mb);\ndiff --git a/lib/librte_ip_frag/rte_ipv6_reassembly.c b/lib/librte_ip_frag/rte_ipv6_reassembly.c\nindex db249fe60..855e3f740 100644\n--- a/lib/librte_ip_frag/rte_ipv6_reassembly.c\n+++ b/lib/librte_ip_frag/rte_ipv6_reassembly.c\n@@ -59,8 +59,11 @@ ipv6_frag_reassemble(struct ip_frag_pkt *fp)\n \t\t\t/* previous fragment found. */\n \t\t\tif (fp->frags[i].ofs + fp->frags[i].len == ofs) {\n \n+\t\t\t\tRTE_ASSERT(curr_idx != i);\n+\n \t\t\t\t/* adjust start of the last fragment data. */\n-\t\t\t\trte_pktmbuf_adj(m, (uint16_t)(m->l2_len + m->l3_len));\n+\t\t\t\trte_pktmbuf_adj(m,\n+\t\t\t\t\t(uint16_t)(m->l2_len + m->l3_len));\n \t\t\t\trte_pktmbuf_chain(fp->frags[i].mb, m);\n \n \t\t\t\t/* this mbuf should not be accessed directly */\n@@ -135,12 +138,13 @@ ipv6_frag_reassemble(struct ip_frag_pkt *fp)\n #define FRAG_OFFSET(x) (rte_cpu_to_be_16(x) >> 3)\n struct rte_mbuf *\n rte_ipv6_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n-\t\tstruct rte_ip_frag_death_row *dr, struct rte_mbuf *mb, uint64_t tms,\n-\t\tstruct ipv6_hdr *ip_hdr, struct ipv6_extension_fragment *frag_hdr)\n+\tstruct rte_ip_frag_death_row *dr, struct rte_mbuf *mb, uint64_t tms,\n+\tstruct ipv6_hdr *ip_hdr, struct ipv6_extension_fragment *frag_hdr)\n {\n \tstruct ip_frag_pkt *fp;\n \tstruct ip_frag_key key;\n-\tuint16_t ip_len, ip_ofs;\n+\tuint16_t ip_ofs;\n+\tint32_t ip_len;\n \n \trte_memcpy(&key.src_dst[0], ip_hdr->src_addr, 16);\n \trte_memcpy(&key.src_dst[2], ip_hdr->dst_addr, 16);\n@@ -151,15 +155,17 @@ rte_ipv6_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n \tip_ofs = FRAG_OFFSET(frag_hdr->frag_data) * 8;\n \n \t/*\n-\t * as per RFC2460, payload length contains all extension headers as well.\n-\t * since we don't support anything but frag headers, this is what we remove\n-\t * from the payload len.\n+\t * as per RFC2460, payload length contains all extension headers\n+\t * as well.\n+\t * since we don't support anything but frag headers,\n+\t * this is what we remove from the payload len.\n \t */\n \tip_len = rte_be_to_cpu_16(ip_hdr->payload_len) - sizeof(*frag_hdr);\n \n \tIP_FRAG_LOG(DEBUG, \"%s:%d:\\n\"\n \t\t\"mbuf: %p, tms: %\" PRIu64\n-\t\t\", key: <\" IPv6_KEY_BYTES_FMT \", %#x>, ofs: %u, len: %u, flags: %#x\\n\"\n+\t\t\", key: <\" IPv6_KEY_BYTES_FMT \", %#x>, \"\n+\t\t\"ofs: %u, len: %d, flags: %#x\\n\"\n \t\t\"tbl: %p, max_cycles: %\" PRIu64 \", entry_mask: %#x, \"\n \t\t\"max_entries: %u, use_entries: %u\\n\\n\",\n \t\t__func__, __LINE__,\n@@ -168,6 +174,12 @@ rte_ipv6_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,\n \t\ttbl, tbl->max_cycles, tbl->entry_mask, tbl->max_entries,\n \t\ttbl->use_entries);\n \n+\t/* check that fragment length is greater then zero. */\n+\tif (ip_len <= 0) {\n+\t\tIP_FRAG_MBUF2DR(dr, mb);\n+\t\treturn NULL;\n+\t}\n+\n \t/* try to find/add entry into the fragment's table. */\n \tfp = ip_frag_find(tbl, dr, &key, tms);\n \tif (fp == NULL) {\n", "prefixes": [ "v2", "1/2" ] }