qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Jason Wang <jasowang@redhat.com>
To: qemu-devel@nongnu.org, peter.maydell@linaro.org
Cc: Zhang Chen <chen.zhang@intel.com>, Tao Xu <tao3.xu@intel.com>,
	Li Zhijian <lizhijian@fujitsu.com>,
	Jason Wang <jasowang@redhat.com>
Subject: [PULL 24/24] net/colo.c: fix segmentation fault when packet is not parsed correctly
Date: Tue, 19 Jul 2022 21:16:37 +0800	[thread overview]
Message-ID: <20220719131637.46131-25-jasowang@redhat.com> (raw)
In-Reply-To: <20220719131637.46131-1-jasowang@redhat.com>

From: Zhang Chen <chen.zhang@intel.com>

When COLO use only one vnet_hdr_support parameter between
filter-redirector and filter-mirror(or colo-compare), COLO will crash
with segmentation fault. Back track as follow:

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
    at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
296         uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(p)->h_proto);
(gdb) bt
0  0x0000555555cb200b in eth_get_l2_hdr_length (p=0x0)
    at /home/tao/project/COLO/colo-qemu/include/net/eth.h:296
1  0x0000555555cb22b4 in parse_packet_early (pkt=0x555556a44840) at
net/colo.c:49
2  0x0000555555cb2b91 in is_tcp_packet (pkt=0x555556a44840) at
net/filter-rewriter.c:63

So wrong vnet_hdr_len will cause pkt->data become NULL. Add check to
raise error and add trace-events to track vnet_hdr_len.

Signed-off-by: Tao Xu <tao3.xu@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo.c       | 9 ++++++++-
 net/trace-events | 1 +
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/colo.c b/net/colo.c
index 694f3c9..6b0ff56 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -46,7 +46,14 @@ int parse_packet_early(Packet *pkt)
     static const uint8_t vlan[] = {0x81, 0x00};
     uint8_t *data = pkt->data + pkt->vnet_hdr_len;
     uint16_t l3_proto;
-    ssize_t l2hdr_len = eth_get_l2_hdr_length(data);
+    ssize_t l2hdr_len;
+
+    if (data == NULL) {
+        trace_colo_proxy_main_vnet_info("This packet is not parsed correctly, "
+                                        "pkt->vnet_hdr_len", pkt->vnet_hdr_len);
+        return 1;
+    }
+    l2hdr_len = eth_get_l2_hdr_length(data);
 
     if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) {
         trace_colo_proxy_main("pkt->size < ETH_HLEN");
diff --git a/net/trace-events b/net/trace-events
index d7a1725..6af927b 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -9,6 +9,7 @@ vhost_user_event(const char *chr, int event) "chr: %s got event: %d"
 
 # colo.c
 colo_proxy_main(const char *chr) ": %s"
+colo_proxy_main_vnet_info(const char *sta, int size) ": %s = %d"
 
 # colo-compare.c
 colo_compare_main(const char *chr) ": %s"
-- 
2.7.4



  parent reply	other threads:[~2022-07-19 13:35 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-19 13:16 [PULL 00/24] Net Patches Jason Wang
2022-07-19 13:16 ` [PULL 01/24] vhost: move descriptor translation to vhost_svq_vring_write_descs Jason Wang
2022-07-19 13:16 ` [PULL 02/24] virtio-net: Expose MAC_TABLE_ENTRIES Jason Wang
2022-07-19 13:16 ` [PULL 03/24] virtio-net: Expose ctrl virtqueue logic Jason Wang
2022-07-19 13:16 ` [PULL 04/24] vdpa: Avoid compiler to squash reads to used idx Jason Wang
2022-07-19 13:16 ` [PULL 05/24] vhost: Reorder vhost_svq_kick Jason Wang
2022-07-19 13:16 ` [PULL 06/24] vhost: Move vhost_svq_kick call to vhost_svq_add Jason Wang
2022-07-19 13:16 ` [PULL 07/24] vhost: Check for queue full at vhost_svq_add Jason Wang
2022-07-19 13:16 ` [PULL 08/24] vhost: Decouple vhost_svq_add from VirtQueueElement Jason Wang
2022-07-19 13:16 ` [PULL 09/24] vhost: Add SVQDescState Jason Wang
2022-07-19 13:16 ` [PULL 10/24] vhost: Track number of descs in SVQDescState Jason Wang
2022-07-19 13:16 ` [PULL 11/24] vhost: add vhost_svq_push_elem Jason Wang
2022-07-19 13:16 ` [PULL 12/24] vhost: Expose vhost_svq_add Jason Wang
2022-07-19 13:16 ` [PULL 13/24] vhost: add vhost_svq_poll Jason Wang
2022-07-19 13:16 ` [PULL 14/24] vhost: Add svq avail_handler callback Jason Wang
2022-07-19 13:16 ` [PULL 15/24] vdpa: Export vhost_vdpa_dma_map and unmap calls Jason Wang
2022-07-19 13:16 ` [PULL 16/24] vdpa: manual forward CVQ buffers Jason Wang
2022-07-19 13:16 ` [PULL 17/24] vdpa: Buffer CVQ support on shadow virtqueue Jason Wang
2022-07-19 13:16 ` [PULL 18/24] vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs Jason Wang
2022-07-19 13:16 ` [PULL 19/24] vdpa: Add device migration blocker Jason Wang
2022-07-19 13:16 ` [PULL 20/24] vdpa: Add x-svq to NetdevVhostVDPAOptions Jason Wang
2022-07-19 13:16 ` [PULL 21/24] softmmu/runstate.c: add RunStateTransition support form COLO to PRELAUNCH Jason Wang
2022-07-19 13:16 ` [PULL 22/24] net/colo: Fix a "double free" crash to clear the conn_list Jason Wang
2022-07-19 13:16 ` [PULL 23/24] net/colo.c: No need to track conn_list for filter-rewriter Jason Wang
2022-07-19 13:16 ` Jason Wang [this message]
2022-07-19 16:40 ` [PULL 00/24] Net Patches Peter Maydell
2022-07-20  3:40   ` Jason Wang
2022-07-20  6:02     ` Eugenio Perez Martin
2022-07-20  6:06       ` Jason Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220719131637.46131-25-jasowang@redhat.com \
    --to=jasowang@redhat.com \
    --cc=chen.zhang@intel.com \
    --cc=lizhijian@fujitsu.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    --cc=tao3.xu@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).