packet_set_ipv6() calls packet_rh_present() which expects L3 and L4
offsets to be set in the packet. If not, it may incorrectly iterate
outside the bounds of the packet.
We now call dp_packet_set_l4() before packet_set_ipv6() in
pinctrl_compose_ipv6(). This also means that now packet_set_ipv6() will
update the L4 checksums so we need to make sure we zero them out when
recomputing them, e.g., in pinctrl_handle_tcp_reset().
Reported by AddressSanitizer:
==3919971==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7fd9eecfc7b4 at pc 0x00000065d7a7 bp 0x7fd9eecfc580 sp 0x7fd9eecfc578
READ of size 1 at 0x7fd9eecfc7b4 thread T1 (ovn_pinctrl0)
#0 0x65d7a6 in packet_rh_present lib/packets.c:1220
#1 0x65d7a6 in packet_set_ipv6 lib/packets.c:1339
#2 0x450eeb in pinctrl_compose_ipv6 controller/pinctrl.c:4577
#3 0x4540f3 in ip_mcast_querier_send_mld controller/pinctrl.c:5408
#4 0x478de5 in ip_mcast_querier_send controller/pinctrl.c:5463
#5 0x478de5 in ip_mcast_querier_run controller/pinctrl.c:5486
#6 0x478de5 in pinctrl_handler controller/pinctrl.c:3400
#7 0x62f183 in ovsthread_wrapper lib/ovs-thread.c:422
#8 0x7fd9f26cd298 in start_thread
/usr/src/debug/glibc-2.33-20.fc34.x86_64/nptl/pthread_create.c:481
#9 0x7fd9f24a4352 in clone (/lib64/libc.so.6+0x100352)
Address 0x7fd9eecfc7b4 is located in stack of thread T1 (ovn_pinctrl0) at
offset 292 in frame
#0 0x453eff in ip_mcast_querier_send_mld controller/pinctrl.c:5402
This frame has 6 object(s):
[32, 48) 'unspecified' (line 5422)
[64, 128) 'ofpacts' (line 5427)
[160, 288) 'packet_stub' (line 5404) <== Memory access at offset 292
overflows this variable
Fixes: 6e475f9d03d9 ("pinctrl: Ensure proper alignment when using
pinctrl_compose_ipv*().")
Signed-off-by: Dumitru Ceara <dce...@redhat.com>
---
controller/pinctrl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/controller/pinctrl.c b/controller/pinctrl.c
index fe1358990..c61850e9f 100644
--- a/controller/pinctrl.c
+++ b/controller/pinctrl.c
@@ -1779,6 +1779,7 @@ pinctrl_handle_tcp_reset(struct rconn *swconn, const
struct flow *ip_flow,
struct tcp_header *th = dp_packet_l4(&packet);
+ th->tcp_csum = 0;
th->tcp_dst = ip_flow->tp_src;
th->tcp_src = ip_flow->tp_dst;
@@ -4575,8 +4576,8 @@ pinctrl_compose_ipv6(struct dp_packet *packet, struct
eth_addr eth_src,
nh->ip6_nxt = ip_proto;
nh->ip6_plen = htons(ip_payload_len);
- packet_set_ipv6(packet, ipv6_src, ipv6_dst, 0, 0, ttl);
dp_packet_set_l4(packet, nh + 1);
+ packet_set_ipv6(packet, ipv6_src, ipv6_dst, 0, 0, ttl);
}
/*
--
2.27.0
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
