diff options
| author | Darrell Ball <dlu998@gmail.com> | 2019-09-23 16:44:33 -0700 |
|---|---|---|
| committer | Ben Pfaff <blp@ovn.org> | 2019-09-24 12:51:30 -0700 |
| commit | a0b89c5139aba1e4ea1fa1bf79c69b4b20cc492f (patch) | |
| tree | d5b21bc06cff7fa8729ff3e2c69bf3480fa6f49f /lib/conntrack.c | |
| parent | 1f5094270b45f87fc6cffc2530d55b4e4e8f852d (diff) | |
| download | openvswitch-a0b89c5139aba1e4ea1fa1bf79c69b4b20cc492f.tar.gz | |
conntrack: Fix 'check_orig_tuple()' Valgrind false positive.
Valgrind reported that 'pkt->md.ct_orig_tuple.ipv4.ipv4_proto' is
uninitialized in 'check_orig_tuple()', if 'ct_state' is zero. Although
this is true, the check is superceded, as even if it succeeds the check
for natted packets based on 'ct_state' is an ORed condition and is intended
to catch this case.
The check is '!(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT))' which
filters out all packets excepted natted ones. Move this check up to
prevent the Valgrind complaint, which also helps performance and also remove
recenlty added redundant check adding extra cycles.
Fixes: f44733c527da ("conntrack: Validate accessing of conntrack data in pkt_metadata.")
CC: Yifeng Sun <pkusunyifeng@gmail.com>
Signed-off-by: Darrell Ball <dlu998@gmail.com>
Signed-off-by: Ben Pfaff <blp@ovn.org>
Diffstat (limited to 'lib/conntrack.c')
| -rw-r--r-- | lib/conntrack.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/lib/conntrack.c b/lib/conntrack.c index 86c16b2fb..0c917543c 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1001,11 +1001,11 @@ check_orig_tuple(struct conntrack *ct, struct dp_packet *pkt, struct conn **conn, const struct nat_action_info_t *nat_action_info) { - if ((ctx_in->key.dl_type == htons(ETH_TYPE_IP) && + if (!(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) || + (ctx_in->key.dl_type == htons(ETH_TYPE_IP) && !pkt->md.ct_orig_tuple.ipv4.ipv4_proto) || (ctx_in->key.dl_type == htons(ETH_TYPE_IPV6) && !pkt->md.ct_orig_tuple.ipv6.ipv6_proto) || - !(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) || nat_action_info) { return false; } @@ -1138,8 +1138,7 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, handle_nat(pkt, conn, zone, ctx->reply, ctx->icmp_related); } - } else if (pkt->md.ct_state - && check_orig_tuple(ct, pkt, ctx, now, &conn, nat_action_info)) { + } else if (check_orig_tuple(ct, pkt, ctx, now, &conn, nat_action_info)) { create_new_conn = conn_update_state(ct, pkt, ctx, conn, now); } else { if (ctx->icmp_related) { |