-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dpif-netdev: Put ovsthread_once_done inside ovsthread_once_start code… #16
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… block Signed-off-by: Yifeng Sun <pkusunyifeng@gmail.com>
YiHungWei
approved these changes
Nov 9, 2018
williamtu
pushed a commit
that referenced
this pull request
Jul 31, 2019
The following, run inside the OVS sandbox, caused OVS to abort when Address Sanitizer was used: ovs-vsctl add-br br-int ovs-ofctl add-flow br-int "table=0,cookie=0x1234,priority=10000,icmp,actions=drop" ovs-ofctl --strict del-flows br-int "table=0,cookie=0x1234/-1,priority=10000" Sample report from Address Sanitizer: ==3029==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000043260 at pc 0x7f6b09c2459b bp 0x7ffcb67e7540 sp 0x7ffcb67e6cf0 READ of size 40 at 0x603000043260 thread T0 #0 0x7f6b09c2459a (/lib/x86_64-linux-gnu/libasan.so.5+0xb859a) #1 0x565110a748a5 in minimask_equal ../lib/flow.c:3510 #2 0x565110a9ea41 in minimatch_equal ../lib/match.c:1821 #3 0x56511091e864 in collect_rules_strict ../ofproto/ofproto.c:4516 #4 0x56511093d526 in delete_flow_start_strict ../ofproto/ofproto.c:5959 #5 0x56511093d526 in ofproto_flow_mod_start ../ofproto/ofproto.c:7949 #6 0x56511093d77b in handle_flow_mod__ ../ofproto/ofproto.c:6122 #7 0x56511093db71 in handle_flow_mod ../ofproto/ofproto.c:6099 #8 0x5651109407f6 in handle_single_part_openflow ../ofproto/ofproto.c:8406 #9 0x5651109407f6 in handle_openflow ../ofproto/ofproto.c:8587 #10 0x5651109e40da in ofconn_run ../ofproto/connmgr.c:1318 #11 0x5651109e40da in connmgr_run ../ofproto/connmgr.c:355 #12 0x56511092b129 in ofproto_run ../ofproto/ofproto.c:1826 #13 0x5651108f23cd in bridge_run__ ../vswitchd/bridge.c:2965 #14 0x565110904887 in bridge_run ../vswitchd/bridge.c:3023 #15 0x5651108e659c in main ../vswitchd/ovs-vswitchd.c:127 #16 0x7f6b093b709a in __libc_start_main ../csu/libc-start.c:308 #17 0x5651108e9009 in _start (/home/blp/nicira/ovs/_build/vswitchd/ovs-vswitchd+0x11d009) This fixes the problem, which although largely theoretical could crop up with odd implementations of memcmp(), perhaps ones optimized in various "clever" ways. All in all, it seems best to avoid the theoretical problem. Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
PlumeTomi
pushed a commit
to PlumeTomi/ovs-ebpf
that referenced
this pull request
Aug 8, 2021
OVS uses memcmp to compare actions of existing and new flows, but 'struct ofp_ed_prop_nsh_md_type' and corresponding ofpact structure has 3 bytes of padding that never initialized and passed around within OF data structures and messages. Uninitialized bytes in MemcmpInterceptorCommon at offset 21 inside [0x7090000003f8, 136) WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x4a184e in bcmp (vswitchd/ovs-vswitchd+0x4a184e) williamtu#1 0x896c8a in ofpacts_equal lib/ofp-actions.c:9121:31 williamtu#2 0x564403 in replace_rule_finish ofproto/ofproto.c:5650:37 williamtu#3 0x563462 in add_flow_finish ofproto/ofproto.c:5218:13 williamtu#4 0x54a1ff in ofproto_flow_mod_finish ofproto/ofproto.c:8091:17 williamtu#5 0x5433b2 in handle_flow_mod__ ofproto/ofproto.c:6216:17 williamtu#6 0x56a2fc in handle_flow_mod ofproto/ofproto.c:6190:17 williamtu#7 0x565bda in handle_single_part_openflow ofproto/ofproto.c:8504:16 williamtu#8 0x540b25 in handle_openflow ofproto/ofproto.c:8685:21 williamtu#9 0x6697fd in ofconn_run ofproto/connmgr.c:1329:13 williamtu#10 0x668e6e in connmgr_run ofproto/connmgr.c:356:9 williamtu#11 0x53f1bc in ofproto_run ofproto/ofproto.c:1890:5 williamtu#12 0x4ead0c in bridge_run__ vswitchd/bridge.c:3250:9 williamtu#13 0x4e9bc8 in bridge_run vswitchd/bridge.c:3309:5 williamtu#14 0x51c072 in main vswitchd/ovs-vswitchd.c:127:9 williamtu#15 0x7f23a99011a2 in __libc_start_main (/lib64/libc.so.6) williamtu#16 0x46b92d in _start (vswitchd/ovs-vswitchd+0x46b92d) Uninitialized value was stored to memory at #0 0x4745aa in __msan_memcpy.part.0 (vswitchd/ovs-vswitchd) williamtu#1 0x54529f in rule_actions_create ofproto/ofproto.c:3134:5 williamtu#2 0x54915e in ofproto_rule_create ofproto/ofproto.c:5284:11 williamtu#3 0x55d419 in add_flow_init ofproto/ofproto.c:5123:17 williamtu#4 0x54841f in ofproto_flow_mod_init ofproto/ofproto.c:7987:17 williamtu#5 0x543250 in handle_flow_mod__ ofproto/ofproto.c:6206:13 williamtu#6 0x56a2fc in handle_flow_mod ofproto/ofproto.c:6190:17 williamtu#7 0x565bda in handle_single_part_openflow ofproto/ofproto.c:8504:16 williamtu#8 0x540b25 in handle_openflow ofproto/ofproto.c:8685:21 williamtu#9 0x6697fd in ofconn_run ofproto/connmgr.c:1329:13 williamtu#10 0x668e6e in connmgr_run ofproto/connmgr.c:356:9 williamtu#11 0x53f1bc in ofproto_run ofproto/ofproto.c:1890:5 williamtu#12 0x4ead0c in bridge_run__ vswitchd/bridge.c:3250:9 williamtu#13 0x4e9bc8 in bridge_run vswitchd/bridge.c:3309:5 williamtu#14 0x51c072 in main vswitchd/ovs-vswitchd.c:127:9 williamtu#15 0x7f23a99011a2 in __libc_start_main (/lib64/libc.so.6) Uninitialized value was created by an allocation of 'ofpacts_stub' in the stack frame of function 'handle_flow_mod' #0 0x569e80 in handle_flow_mod ofproto/ofproto.c:6170 This could cause issues with flow modifications or other operations. To reproduce, some NSH tests could be run under valgrind or clang MemorySantizer. Ex. "nsh - md1 encap over a veth link" test. Fix that by clearing padding bytes while encoding and decoding. OVS will still accept OF messages with non-zero padding from controllers. New tests added to tests/ofp-actions.at. Fixes: 1fc11c5 ("Generic encap and decap support for NSH") Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Jan Scheurich <jan.scheurich@ericsson.com>
PlumeTomi
pushed a commit
to PlumeTomi/ovs-ebpf
that referenced
this pull request
Aug 8, 2021
If datapath flow doesn't have one of the fields of gtpu metadata, e.g. 'tunnel(gtpu())', uninitialized stack memory will be used instead. ==3485429==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x853a1b in format_u8x lib/odp-util.c:3474:13 williamtu#1 0x86ee9c in format_odp_tun_gtpu_opt lib/odp-util.c:3713:5 williamtu#2 0x86a099 in format_odp_tun_attr lib/odp-util.c:3973:13 williamtu#3 0x83afe6 in format_odp_key_attr__ lib/odp-util.c:4179:9 williamtu#4 0x838afb in odp_flow_format lib/odp-util.c:4563:17 williamtu#5 0x738422 in log_flow_message lib/dpif.c:1750:5 williamtu#6 0x738e2f in log_flow_put_message lib/dpif.c:1784:9 williamtu#7 0x7371a4 in dpif_operate lib/dpif.c:1377:21 williamtu#8 0x7363ef in dpif_flow_put lib/dpif.c:1035:5 williamtu#9 0xc7aab7 in dpctl_put_flow lib/dpctl.c:1171:13 williamtu#10 0xc65a4f in dpctl_unixctl_handler lib/dpctl.c:2701:17 williamtu#11 0xaaad04 in process_command lib/unixctl.c:308:13 williamtu#12 0xaa87f7 in run_connection lib/unixctl.c:342:17 williamtu#13 0xaa842e in unixctl_server_run lib/unixctl.c:393:21 williamtu#14 0x51c09c in main vswitchd/ovs-vswitchd.c:128:9 williamtu#15 0x7f88344391a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) williamtu#16 0x46b92d in _start (vswitchd/ovs-vswitchd+0x46b92d) Uninitialized value was stored to memory at #0 0x87da17 in scan_gtpu_metadata lib/odp-util.c:5221:27 williamtu#1 0x874588 in parse_odp_key_mask_attr__ lib/odp-util.c:5862:9 williamtu#2 0x83ee14 in parse_odp_key_mask_attr lib/odp-util.c:5808:18 williamtu#3 0x83e8b5 in odp_flow_from_string lib/odp-util.c:6065:18 williamtu#4 0xc7a4f3 in dpctl_put_flow lib/dpctl.c:1145:13 williamtu#5 0xc65a4f in dpctl_unixctl_handler lib/dpctl.c:2701:17 williamtu#6 0xaaad04 in process_command lib/unixctl.c:308:13 williamtu#7 0xaa87f7 in run_connection lib/unixctl.c:342:17 williamtu#8 0xaa842e in unixctl_server_run lib/unixctl.c:393:21 williamtu#9 0x51c09c in main vswitchd/ovs-vswitchd.c:128:9 williamtu#10 0x7f88344391a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) Uninitialized value was created by an allocation of 'msgtype_ma' in the stack frame of function 'scan_gtpu_metadata' #0 0x87d440 in scan_gtpu_metadata lib/odp-util.c:5187 Fix that by initializing fields to all zeroes by default. Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21426 Fixes: 3c6d05a ("userspace: Add GTP-U support.") Acked-by: Yi Yang <yangyi01@inspur.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
… block
Signed-off-by: Yifeng Sun pkusunyifeng@gmail.com