From: Bruce Richardson <bruce.richardson@intel.com>
To: Jiayu Hu <jiayu.hu@intel.com>
Cc: dev@dpdk.org, tiwei.bie@intel.com, stable@dpdk.org
Subject: Re: [PATCH] gro: fix overflow of TCP Options length calculation
Date: Mon, 7 Jan 2019 14:29:55 +0000 [thread overview]
Message-ID: <20190107142955.GC14912@bricha3-MOBL.ger.corp.intel.com> (raw)
In-Reply-To: <1546567036-29444-1-git-send-email-jiayu.hu@intel.com>
On Fri, Jan 04, 2019 at 09:57:16AM +0800, Jiayu Hu wrote:
> If we receive a packet with an invalid TCP header, whose
> TCP header length is less than 20 bytes (the minimal TCP
> header length), the calculated TCP Options length will
> overflow and result in incorrect reassembly behaviors.
Please explain how changing the "len" type fixes this behaviour.
>
> Fixes: 0d2cbe59b719 ("lib/gro: support TCP/IPv4")
> Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO")
> Cc: stable@dpdk.org
>
> Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
> ---
> lib/librte_gro/gro_tcp4.h | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/lib/librte_gro/gro_tcp4.h b/lib/librte_gro/gro_tcp4.h
> index 6bb30cd..189cea3 100644
> --- a/lib/librte_gro/gro_tcp4.h
> +++ b/lib/librte_gro/gro_tcp4.h
> @@ -266,7 +266,8 @@ check_seq_option(struct gro_tcp4_item *item,
> struct rte_mbuf *pkt_orig = item->firstseg;
> struct ipv4_hdr *iph_orig;
> struct tcp_hdr *tcph_orig;
> - uint16_t len, tcp_hl_orig;
> + uint16_t tcp_hl_orig;
> + int32_t len;
>
> iph_orig = (struct ipv4_hdr *)(rte_pktmbuf_mtod(pkt_orig, char *) +
> l2_offset + pkt_orig->l2_len);
> --
> 2.7.4
>
next prev parent reply other threads:[~2019-01-07 14:29 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-04 1:57 [PATCH] gro: fix overflow of TCP Options length calculation Jiayu Hu
2019-01-07 14:29 ` Bruce Richardson [this message]
2019-01-08 1:22 ` Hu, Jiayu
2019-01-08 6:19 ` Stephen Hemminger
2019-01-08 6:08 ` [PATCH] gro: add missing invalid packet checks Jiayu Hu
2019-01-08 6:31 ` Stephen Hemminger
2019-01-08 8:14 ` Hu, Jiayu
2019-01-08 10:39 ` Ananyev, Konstantin
2019-01-08 11:33 ` Morten Brørup
2019-01-08 13:40 ` Hu, Jiayu
2019-01-08 13:43 ` Ananyev, Konstantin
2019-01-08 14:50 ` Morten Brørup
2019-01-09 3:32 ` Hu, Jiayu
2019-01-10 15:06 ` [PATCH v2] " Jiayu Hu
2019-01-14 22:26 ` [dpdk-stable] " Thomas Monjalon
2019-01-15 1:00 ` Stephen Hemminger
2019-01-15 2:48 ` Hu, Jiayu
2019-01-15 5:05 ` Wang, Yinan
2019-01-15 10:11 ` Ananyev, Konstantin
2019-01-15 12:18 ` Hu, Jiayu
2019-01-15 13:38 ` Hu, Jiayu
2019-01-16 0:45 ` [PATCH v3] gro: add missing invalid TCP header length check Jiayu Hu
2019-01-16 9:49 ` Ananyev, Konstantin
2019-01-17 21:41 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190107142955.GC14912@bricha3-MOBL.ger.corp.intel.com \
--to=bruce.richardson@intel.com \
--cc=dev@dpdk.org \
--cc=jiayu.hu@intel.com \
--cc=stable@dpdk.org \
--cc=tiwei.bie@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.