On Thu, Jul 14, 2022 at 07:34:29AM +0200, Simon Horman wrote:
> On Wed, Jul 13, 2022 at 04:35:31PM +0200, Ilya Maximets wrote:
> > calc_offsets() function returns 'data' and 'mask' pointers, which
> > are pointers somewhere inside struct tc_flower_key, and they are not
> > aligned, causing misaligned memory access. For example:
> >
> > ipv6.rewrite_hlimit is at 148 byte offset inside the struct
> > tc_flower_key. While the actual field is in the 7th byte of
> > the IPv6 header in the actual packet. So, pedit will need
> > to write the last byte of the [4-7] range to the actual packet.
> > So, data pointer is positioned to 145th byte inside the tc_flower_key
> > with the 000000FF mask. Obviously, 145th byte inside the structure
> > is not 4-byte aligned.
> >
> > lib/tc.c:2879:34: runtime error:
> > load of misaligned address 0x7f2802eaa321 for type 'ovs_be32' (aka
> > 'unsigned int'), which requires 4 byte alignment
> > 0x7f2802eaa321: note: pointer points here
> > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
> > ^
> > 0 0xd7f2fb in nl_msg_put_flower_rewrite_pedits lib/tc.c:2879:34
> > 1 0xd7f2fb in nl_msg_put_flower_acts lib/tc.c:3141:25
> > 2 0xd6ae5a in nl_msg_put_flower_options lib/tc.c:3445:12
> > 3 0xd6a2be in tc_replace_flower lib/tc.c:3712:17
> > 4 0xd2bf25 in netdev_tc_flow_put lib/netdev-offload-tc.c:2224:11
> > 5 0x94f6b7 in netdev_flow_put lib/netdev-offload.c:316:14
> > 6 0xcbd19e in parse_flow_put lib/dpif-netlink.c:2289:11
> > 7 0xcbd19e in try_send_to_netdev lib/dpif-netlink.c:2376:15
> > 8 0xcbd19e in dpif_netlink_operate lib/dpif-netlink.c:2447:23
> > 9 0x86536e in dpif_operate lib/dpif.c:1372:13
> > 10 0x6bc289 in handle_upcalls ofproto/ofproto-dpif-upcall.c:1654:5
> > 11 0x6bc289 in recv_upcalls ofproto/ofproto-dpif-upcall.c:892:9
> > 12 0x6b766a in udpif_upcall_handler ofproto/ofproto-dpif-upcall.c:792:13
> > 13 0xb5015a in ovsthread_wrapper lib/ovs-thread.c:422:12
> > 14 0x7f280b2081ce in start_thread (/lib64/libpthread.so.0+0x81ce)
> > 15 0x7f2809e39dd2 in clone (/lib64/libc.so.6+0x39dd2)
> >
> > Fix misaligned read by using appropriate functions.
> >
> > Fixes: 8ada482bbe19 ("tc: Add header rewrite using tc pedit action")
> > Signed-off-by: Ilya Maximets <[email protected]>
>
> Acked-by: Simon Horman <[email protected]>
>
> I'd also be happy to apply this patch if that was your intention.
Applied to master, and backported to branches back to branch-2.13.
Let me know if you'd like me to backport it further back.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
