From: Zhang Chen <chen.zhang@intel.com>
To: Jason Wang <jasowang@redhat.com>, Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Zhang Chen <chen.zhang@intel.com>, Tao Xu <tao3.xu@intel.com>,
qemu-dev <qemu-devel@nongnu.org>,
Li Zhijian <lizhijian@fujitsu.com>
Subject: [PATCH V2 4/4] net/colo.c: fix segmentation fault when packet is not parsed correctly
Date: Fri, 1 Apr 2022 11:47:02 +0800 [thread overview]
Message-ID: <20220401034702.687057-5-chen.zhang@intel.com> (raw)
In-Reply-To: <20220401034702.687057-1-chen.zhang@intel.com>
When COLO use only one vnet_hdr_support parameter between
filter-redirector and filter-mirror(or colo-compare), COLO will crash
with segmentation fault. Back track as follow:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
296 uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(p)->h_proto);
(gdb) bt
0 0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
1 0x0000555555cb22b4 in parse_packet_early (pkt=0x555556a44840) at
net/colo.c:49
2 0x0000555555cb2b91 in is_tcp_packet (pkt=0x555556a44840) at
net/filter-rewriter.c:63
So wrong vnet_hdr_len will cause pkt->data become NULL. Add check to
raise error and add trace-events to track vnet_hdr_len.
Signed-off-by: Tao Xu <tao3.xu@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
---
net/colo.c | 9 ++++++++-
net/trace-events | 1 +
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/colo.c b/net/colo.c
index 694f3c93ef..6b0ff562ad 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -46,7 +46,14 @@ int parse_packet_early(Packet *pkt)
static const uint8_t vlan[] = {0x81, 0x00};
uint8_t *data = pkt->data + pkt->vnet_hdr_len;
uint16_t l3_proto;
- ssize_t l2hdr_len = eth_get_l2_hdr_length(data);
+ ssize_t l2hdr_len;
+
+ if (data == NULL) {
+ trace_colo_proxy_main_vnet_info("This packet is not parsed correctly, "
+ "pkt->vnet_hdr_len", pkt->vnet_hdr_len);
+ return 1;
+ }
+ l2hdr_len = eth_get_l2_hdr_length(data);
if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) {
trace_colo_proxy_main("pkt->size < ETH_HLEN");
diff --git a/net/trace-events b/net/trace-events
index d7a17256cc..6af927b4b9 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -9,6 +9,7 @@ vhost_user_event(const char *chr, int event) "chr: %s got event: %d"
# colo.c
colo_proxy_main(const char *chr) ": %s"
+colo_proxy_main_vnet_info(const char *sta, int size) ": %s = %d"
# colo-compare.c
colo_compare_main(const char *chr) ": %s"
--
2.25.1
next prev parent reply other threads:[~2022-04-01 4:05 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-01 3:46 [PATCH V2 0/4] COLO net and runstate bugfix/optimization Zhang Chen
2022-04-01 3:46 ` [PATCH V2 1/4] softmmu/runstate.c: add RunStateTransition support form COLO to PRELAUNCH Zhang Chen
2022-04-27 8:56 ` Jason Wang
2022-04-27 9:26 ` Zhang, Chen
2022-05-07 2:03 ` Zhang, Chen
2022-05-07 5:08 ` Jason Wang
2022-05-18 13:08 ` Dr. David Alan Gilbert
2022-05-19 2:18 ` Jason Wang
2022-07-06 5:02 ` Zhang, Chen
2022-07-06 5:39 ` Jason Wang
2022-04-01 3:47 ` [PATCH V2 2/4] net/colo: Fix a "double free" crash to clear the conn_list Zhang Chen
2022-04-01 3:47 ` [PATCH V2 3/4] net/colo.c: No need to track conn_list for filter-rewriter Zhang Chen
2022-04-01 3:47 ` Zhang Chen [this message]
2022-04-14 1:52 ` [PATCH V2 0/4] COLO net and runstate bugfix/optimization Zhang, Chen
2022-04-14 3:12 ` Jason Wang
2022-04-14 3:24 ` Zhang, Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401034702.687057-5-chen.zhang@intel.com \
--to=chen.zhang@intel.com \
--cc=jasowang@redhat.com \
--cc=lizhijian@cn.fujitsu.com \
--cc=lizhijian@fujitsu.com \
--cc=qemu-devel@nongnu.org \
--cc=tao3.xu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.