gro: fix overflow of payload length calculation
Checks
Commit Message
When the packet length is smaller than the header length,
the calculated payload length will be overflowed and result
in incorrect reassembly behaviors.
Fixes: 1e4cf4d6d4fb ("gro: cleanup")
Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO")
Cc: stable@dpdk.org
Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
---
lib/librte_gro/gro_tcp4.c | 3 ++-
lib/librte_gro/gro_vxlan_tcp4.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
Comments
17/12/2018 07:05, Jiayu Hu:
> When the packet length is smaller than the header length,
> the calculated payload length will be overflowed and result
> in incorrect reassembly behaviors.
>
> Fixes: 1e4cf4d6d4fb ("gro: cleanup")
> Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO")
> Cc: stable@dpdk.org
>
> Signed-off-by: Jiayu Hu <jiayu.hu@intel.com>
Applied, thanks
@@ -198,7 +198,8 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt,
struct ipv4_hdr *ipv4_hdr;
struct tcp_hdr *tcp_hdr;
uint32_t sent_seq;
- uint16_t tcp_dl, ip_id, hdr_len, frag_off;
+ int32_t tcp_dl;
+ uint16_t ip_id, hdr_len, frag_off;
uint8_t is_atomic;
struct tcp4_flow_key key;
@@ -295,7 +295,8 @@ gro_vxlan_tcp4_reassemble(struct rte_mbuf *pkt,
struct udp_hdr *udp_hdr;
struct vxlan_hdr *vxlan_hdr;
uint32_t sent_seq;
- uint16_t tcp_dl, frag_off, outer_ip_id, ip_id;
+ int32_t tcp_dl;
+ uint16_t frag_off, outer_ip_id, ip_id;
uint8_t outer_is_atomic, is_atomic;
struct vxlan_tcp4_flow_key key;