From: Jiayu Hu <jiayu.hu@intel.com>
To: dev@dpdk.org
Cc: tiwei.bie@intel.com, Jiayu Hu <jiayu.hu@intel.com>, stable@dpdk.org
Subject: [dpdk-dev] [PATCH] gro: fix overflow of TCP Options length calculation
Date: Fri, 4 Jan 2019 09:57:16 +0800 [thread overview]
Message-ID: <1546567036-29444-1-git-send-email-jiayu.hu@intel.com> (raw)
If we receive a packet with an invalid TCP header, whose
TCP header length is less than 20 bytes (the minimal TCP
header length), the calculated TCP Options length will
overflow and result in incorrect reassembly behaviors.
Fixes: 0d2cbe59b719 ("lib/gro: support TCP/IPv4")
Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO")
Cc: stable@dpdk.org
Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
---
lib/librte_gro/gro_tcp4.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/librte_gro/gro_tcp4.h b/lib/librte_gro/gro_tcp4.h
index 6bb30cd..189cea3 100644
--- a/lib/librte_gro/gro_tcp4.h
+++ b/lib/librte_gro/gro_tcp4.h
@@ -266,7 +266,8 @@ check_seq_option(struct gro_tcp4_item *item,
struct rte_mbuf *pkt_orig = item->firstseg;
struct ipv4_hdr *iph_orig;
struct tcp_hdr *tcph_orig;
- uint16_t len, tcp_hl_orig;
+ uint16_t tcp_hl_orig;
+ int32_t len;
iph_orig = (struct ipv4_hdr *)(rte_pktmbuf_mtod(pkt_orig, char *) +
l2_offset + pkt_orig->l2_len);
--
2.7.4
next reply other threads:[~2019-01-04 1:57 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-04 1:57 Jiayu Hu [this message]
2019-01-07 14:29 ` Bruce Richardson
2019-01-08 1:22 ` Hu, Jiayu
2019-01-08 6:19 ` Stephen Hemminger
2019-01-08 6:08 ` [dpdk-dev] [PATCH] gro: add missing invalid packet checks Jiayu Hu
2019-01-08 6:31 ` Stephen Hemminger
2019-01-08 8:14 ` Hu, Jiayu
2019-01-08 10:39 ` Ananyev, Konstantin
2019-01-08 11:33 ` Morten Brørup
2019-01-08 13:40 ` Hu, Jiayu
2019-01-08 13:43 ` Ananyev, Konstantin
2019-01-08 14:50 ` Morten Brørup
2019-01-09 3:32 ` Hu, Jiayu
2019-01-10 15:06 ` [dpdk-dev] [PATCH v2] " Jiayu Hu
2019-01-14 22:26 ` [dpdk-dev] [dpdk-stable] " Thomas Monjalon
2019-01-15 1:00 ` [dpdk-dev] " Stephen Hemminger
2019-01-15 2:48 ` Hu, Jiayu
2019-01-15 5:05 ` Wang, Yinan
2019-01-15 10:11 ` Ananyev, Konstantin
2019-01-15 12:18 ` Hu, Jiayu
2019-01-15 13:38 ` Hu, Jiayu
2019-01-16 0:45 ` [dpdk-dev] [PATCH v3] gro: add missing invalid TCP header length check Jiayu Hu
2019-01-16 9:49 ` Ananyev, Konstantin
2019-01-17 21:41 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1546567036-29444-1-git-send-email-jiayu.hu@intel.com \
--to=jiayu.hu@intel.com \
--cc=dev@dpdk.org \
--cc=stable@dpdk.org \
--cc=tiwei.bie@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).