diff options
| author | Ben Pfaff <blp@nicira.com> | 2013-01-21 14:29:15 -0800 |
|---|---|---|
| committer | Ben Pfaff <blp@nicira.com> | 2013-01-21 14:43:39 -0800 |
| commit | 5060efced9c8e25921677344efe2a8219fccb58c (patch) | |
| tree | 438f0d8d2cc023f476a42747f432f634a585c4ea | |
| parent | 27febf35dcc2d9ab16aae505f45be62b81516ae6 (diff) | |
| download | openvswitch-5060efced9c8e25921677344efe2a8219fccb58c.tar.gz | |
datapath: Avoid null deref when GSO is for verifying header integrity only.
skb_gso_segment() has the following comment:
* It may return NULL if the skb requires no segmentation. This is
* only possible when GSO is used for verifying header integrity.
Somehow queue_gso_packets() has never hit this case before, but some
failures have suddenly been reported. This commit should fix the problem.
Additional commentary by Jesse: We shouldn't normally be hitting this case
because we're actually trying to do GSO, not header validation. However, I
guess the guest/backend must be generating a packet with an MSS, which
tricks us into thinking that it's GSO, but no GSO is actually requested.
In the case of the bridge, header validation does take place so the
situation is handled already. It seems not ideal that the network backend
doesn't sanitize these packets but it's probably good that we handle
it in any case.
Bug #14772.
Reported-by: Deepesh Govindan <dgovindan@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Jesse Gross <jesse@nicira.com>
| -rw-r--r-- | datapath/datapath.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/datapath/datapath.c b/datapath/datapath.c index f15e270a1..d07dacbbd 100644 --- a/datapath/datapath.c +++ b/datapath/datapath.c @@ -414,6 +414,8 @@ static int queue_gso_packets(struct net *net, int dp_ifindex, segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM); if (IS_ERR(segs)) return PTR_ERR(segs); + if (!segs) + return queue_userspace_packet(net, dp_ifindex, skb, upcall_info); /* Queue all of the segments. */ skb = segs; |