diff options
author | Zhang Chen <chen.zhang@intel.com> | 2022-04-01 11:47:02 +0800 |
---|---|---|
committer | Jason Wang <jasowang@redhat.com> | 2022-07-20 16:58:08 +0800 |
commit | 8bdab83b34efb0b598be4e5b98e4f466ca5f2f80 (patch) | |
tree | 0570f963a7bae97582560d79ba59ff1abee7bf19 /net/colo.c | |
parent | 94c36c48751bf5ff644e6c8e17a21003edacfc5d (diff) | |
download | qemu-8bdab83b34efb0b598be4e5b98e4f466ca5f2f80.zip qemu-8bdab83b34efb0b598be4e5b98e4f466ca5f2f80.tar.gz qemu-8bdab83b34efb0b598be4e5b98e4f466ca5f2f80.tar.bz2 |
net/colo.c: fix segmentation fault when packet is not parsed correctly
When COLO use only one vnet_hdr_support parameter between
filter-redirector and filter-mirror(or colo-compare), COLO will crash
with segmentation fault. Back track as follow:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
296 uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(p)->h_proto);
(gdb) bt
0 0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
1 0x0000555555cb22b4 in parse_packet_early (pkt=0x555556a44840) at
net/colo.c:49
2 0x0000555555cb2b91 in is_tcp_packet (pkt=0x555556a44840) at
net/filter-rewriter.c:63
So wrong vnet_hdr_len will cause pkt->data become NULL. Add check to
raise error and add trace-events to track vnet_hdr_len.
Signed-off-by: Tao Xu <tao3.xu@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net/colo.c')
-rw-r--r-- | net/colo.c | 9 |
1 files changed, 8 insertions, 1 deletions
@@ -46,7 +46,14 @@ int parse_packet_early(Packet *pkt) static const uint8_t vlan[] = {0x81, 0x00}; uint8_t *data = pkt->data + pkt->vnet_hdr_len; uint16_t l3_proto; - ssize_t l2hdr_len = eth_get_l2_hdr_length(data); + ssize_t l2hdr_len; + + if (data == NULL) { + trace_colo_proxy_main_vnet_info("This packet is not parsed correctly, " + "pkt->vnet_hdr_len", pkt->vnet_hdr_len); + return 1; + } + l2hdr_len = eth_get_l2_hdr_length(data); if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) { trace_colo_proxy_main("pkt->size < ETH_HLEN"); |