From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id 1D6391B738; Mon, 16 Oct 2017 16:46:10 +0200 (CEST) Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Oct 2017 07:46:09 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.43,387,1503385200"; d="scan'208";a="138954186" Received: from irsmsx106.ger.corp.intel.com ([163.33.3.31]) by orsmga004.jf.intel.com with ESMTP; 16 Oct 2017 07:46:08 -0700 Received: from irsmsx108.ger.corp.intel.com ([169.254.11.167]) by IRSMSX106.ger.corp.intel.com ([169.254.8.36]) with mapi id 14.03.0319.002; Mon, 16 Oct 2017 15:46:06 +0100 From: "De Lara Guarch, Pablo" To: "Gonzalez Monroy, Sergio" , "Tomasz Duszynski" , "dev@dpdk.org" CC: "stable@dpdk.org" Thread-Topic: [dpdk-stable] [dpdk-dev] [PATCH] examples/ipsec-secgw: fix ip version check Thread-Index: AQHTRmUmwF8rG0mHd0qqqQlKbiSL2KLmje5Q Date: Mon, 16 Oct 2017 14:46:06 +0000 Message-ID: References: <1507899009-20393-1-git-send-email-tdu@semihalf.com> <89f28ab9-22c1-977e-c986-d691408d9a78@intel.com> In-Reply-To: <89f28ab9-22c1-977e-c986-d691408d9a78@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiYTVkNjI0YWItZTMxYS00MjBkLWI3Y2MtOTMxNmM2YzNhODVhIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE2LjUuOS4zIiwiVHJ1c3RlZExhYmVsSGFzaCI6IitsVWxYWFZcL09wcXVndXdvSlFpNDBtTGt1c25aMGtNYmNTdVwvV0oxQzNoVT0ifQ== x-ctpclassification: CTP_IC dlp-product: dlpe-windows dlp-version: 11.0.0.116 dlp-reaction: no-action x-originating-ip: [163.33.239.180] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [dpdk-dev] [dpdk-stable] [PATCH] examples/ipsec-secgw: fix ip version check X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Oct 2017 14:46:11 -0000 > -----Original Message----- > From: stable [mailto:stable-bounces@dpdk.org] On Behalf Of Sergio > Gonzalez Monroy > Sent: Monday, October 16, 2017 10:57 AM > To: Tomasz Duszynski ; dev@dpdk.org > Cc: stable@dpdk.org > Subject: Re: [dpdk-stable] [dpdk-dev] [PATCH] examples/ipsec-secgw: fix i= p > version check >=20 > On 13/10/2017 13:50, Tomasz Duszynski wrote: > > Since new_ip and ip4 are overlapping buffers copying ip4 over new_ip > > using memmove() might overwrite memory at ip4. This could happen if > > following condition holds: > > > > ip_hdr_len > sizeof(struct esp_hdr) + sa->iv_len > > > > Thus using ip4 to check ip version is wrong as it might not contain > > proper value. > > > > Fixes: f159e70b0922 ("examples/ipsec-secgw: support transport mode") > > Cc: stable@dpdk.org > > > > Signed-off-by: Tomasz Duszynski > > --- > > examples/ipsec-secgw/esp.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/examples/ipsec-secgw/esp.c b/examples/ipsec-secgw/esp.c > > index 2897840..063e63f 100644 > > --- a/examples/ipsec-secgw/esp.c > > +++ b/examples/ipsec-secgw/esp.c > > @@ -307,8 +307,8 @@ esp_outbound(struct rte_mbuf *m, struct > ipsec_sa *sa, > > sizeof(struct esp_hdr) + sa->iv_len); > > memmove(new_ip, ip4, ip_hdr_len); > > esp =3D (struct esp_hdr *)(new_ip + ip_hdr_len); > > + ip4 =3D (struct ip *)new_ip; > > if (likely(ip4->ip_v =3D=3D IPVERSION)) { > > - ip4 =3D (struct ip *)new_ip; > > ip4->ip_p =3D IPPROTO_ESP; > > ip4->ip_len =3D htons(rte_pktmbuf_data_len(m)); > > } else { >=20 > Acked-by: Sergio Gonzalez Monroy Applied to dpdk-next-crypto. Thanks, Pablo