From: Zhang Chen <chen.zhang@intel.com>
To: Jason Wang <jasowang@redhat.com>, Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Zhang Chen <chen.zhang@intel.com>, Tao Xu <tao3.xu@intel.com>,
qemu-dev <qemu-devel@nongnu.org>,
Li Zhijian <lizhijian@fujitsu.com>
Subject: [PATCH V2 4/4] net/colo.c: fix segmentation fault when packet is not parsed correctly
Date: Fri, 1 Apr 2022 11:47:02 +0800 [thread overview]
Message-ID: <20220401034702.687057-5-chen.zhang@intel.com> (raw)
In-Reply-To: <20220401034702.687057-1-chen.zhang@intel.com>
When COLO use only one vnet_hdr_support parameter between
filter-redirector and filter-mirror(or colo-compare), COLO will crash
with segmentation fault. Back track as follow:
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
296 uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(p)->h_proto);
(gdb) bt
0 0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
1 0x0000555555cb22b4 in parse_packet_early (pkt=0x555556a44840) at
net/colo.c:49
2 0x0000555555cb2b91 in is_tcp_packet (pkt=0x555556a44840) at
net/filter-rewriter.c:63
So wrong vnet_hdr_len will cause pkt->data become NULL. Add check to
raise error and add trace-events to track vnet_hdr_len.
Signed-off-by: Tao Xu <tao3.xu@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
---
net/colo.c | 9 ++++++++-
net/trace-events | 1 +
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/colo.c b/net/colo.c
index 694f3c93ef..6b0ff562ad 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -46,7 +46,14 @@ int parse_packet_early(Packet *pkt)
static const uint8_t vlan[] = {0x81, 0x00};
uint8_t *data = pkt->data + pkt->vnet_hdr_len;
uint16_t l3_proto;
- ssize_t l2hdr_len = eth_get_l2_hdr_length(data);
+ ssize_t l2hdr_len;
+
+ if (data == NULL) {
+ trace_colo_proxy_main_vnet_info("This packet is not parsed correctly, "
+ "pkt->vnet_hdr_len", pkt->vnet_hdr_len);
+ return 1;
+ }
+ l2hdr_len = eth_get_l2_hdr_length(data);
if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) {
trace_colo_proxy_main("pkt->size < ETH_HLEN");
diff --git a/net/trace-events b/net/trace-events
index d7a17256cc..6af927b4b9 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -9,6 +9,7 @@ vhost_user_event(const char *chr, int event) "chr: %s got event: %d"
# colo.c
colo_proxy_main(const char *chr) ": %s"
+colo_proxy_main_vnet_info(const char *sta, int size) ": %s = %d"
# colo-compare.c
colo_compare_main(const char *chr) ": %s"
--
2.25.1
next prev parent reply other threads:[~2022-04-01 4:05 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-01 3:46 [PATCH V2 0/4] COLO net and runstate bugfix/optimization Zhang Chen
2022-04-01 3:46 ` [PATCH V2 1/4] softmmu/runstate.c: add RunStateTransition support form COLO to PRELAUNCH Zhang Chen
2022-04-27 8:56 ` Jason Wang
2022-04-27 9:26 ` Zhang, Chen
2022-05-07 2:03 ` Zhang, Chen
2022-05-07 5:08 ` Jason Wang
2022-05-18 13:08 ` Dr. David Alan Gilbert
2022-05-19 2:18 ` Jason Wang
2022-07-06 5:02 ` Zhang, Chen
2022-07-06 5:39 ` Jason Wang
2022-04-01 3:47 ` [PATCH V2 2/4] net/colo: Fix a "double free" crash to clear the conn_list Zhang Chen
2022-04-01 3:47 ` [PATCH V2 3/4] net/colo.c: No need to track conn_list for filter-rewriter Zhang Chen
2022-04-01 3:47 ` Zhang Chen [this message]
2022-04-14 1:52 ` [PATCH V2 0/4] COLO net and runstate bugfix/optimization Zhang, Chen
2022-04-14 3:12 ` Jason Wang
2022-04-14 3:24 ` Zhang, Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401034702.687057-5-chen.zhang@intel.com \
--to=chen.zhang@intel.com \
--cc=jasowang@redhat.com \
--cc=lizhijian@cn.fujitsu.com \
--cc=lizhijian@fujitsu.com \
--cc=qemu-devel@nongnu.org \
--cc=tao3.xu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).