On Fri, Jul 09, 2021 at 10:08:39PM +0200, Ilya Maximets wrote:
> On 7/8/21 2:16 PM, Flavio Leitner wrote:
> > On Mon, Jul 05, 2021 at 07:57:41AM -0400, Eelco Chaudron wrote:
> >> When TSO is disabled from a userspace forwarding datapath perspective,
> >> but TSO has been wrongly enabled on the kernel side, log a warning
> >> message, and drop the packet. With the current implementation,
> >> OVS will crash.
> >>
> >> Fixes: 73858f9db ("netdev-linux: Prepend the std packet in the TSO packet")
> >> Signed-off-by: Eelco Chaudron <echau...@redhat.com>
> >> ---
> >> v2: Fixed rx->aux_bufs[i] to allow reuse
> >>
> >> lib/netdev-linux.c | 20 +++++++++++++++++---
> >> 1 file changed, 17 insertions(+), 3 deletions(-)
> Thanks, Eelco and Flavio! I extended the commit message a bit with more
> details why exactly this happens. I also added a different Fixes tag,
> because the actual culprit for the issue is that commit 2109841b7984
> ("Use batch process recv for tap and raw socket in netdev datapath")
> dropped the (retval > size) check without providing an alternative while
> migrating from recvmsg to recvmmsg. This resulted in construction of
> a malformed dp_packet with size larger than the allocated space.
> The crash due to NULL aux_bufs was introduced later by commit 73858f9db.
Yup, thanks for improving the commit.
> Applied and backported down to 2.13.
That's great!
Thanks,
--
fbl
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
