From: Robert Sanford <[email protected]>
When a prefix whose range ends at 255.255.255.255 is added, deleted,
or has its next hop changed, modify_fib() walks the more-specific
routes under it and installs the next hop into the gaps. If the last
of those routes starts exactly at the current left edge and ends at
255.255.255.255, the equal-edges branch advances ledge past it, and
ledge wraps to 0. That branch has no wraparound check, so the loop
continues. With no more routes, the final branch computes redge,
which also wraps to 0. Its ledge != 0 exception, which exists for a
default route added as the first route, lets the call through, and
install_to_fib(dp, 0, 0, nh) overwrites the entire table. The call
returns 0, so the corruption is silent.
For example, with 0.0.0.0/0, 0.0.0.0/1 and 128.0.0.0/1 installed,
deleting 0.0.0.0/0 makes every lookup miss. With 10.0.0.0/8,
255.255.255.0/25 and 255.255.255.128/25 installed, adding
255.255.255.0/24 makes every address, including 10.1.1.1, return the
/24's next hop.
Commit ab1b927cd73e ("fib: fix adding default route overwriting
entire table") added the wraparound check to the other branch only.
Add the same check to the equal-edges branch.
Fixes: 880bc2b5f3bd ("fib: fix adding default route")
Cc: [email protected]
Signed-off-by: Robert Sanford <[email protected]>
---
lib/fib/dir24_8.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/lib/fib/dir24_8.c b/lib/fib/dir24_8.c
index c135285a65..68029c6165 100644
--- a/lib/fib/dir24_8.c
+++ b/lib/fib/dir24_8.c
@@ -436,6 +436,12 @@ modify_fib(struct dir24_8_tbl *dp, struct rte_rib *rib,
uint32_t ip,
if (ledge == redge) {
ledge = redge +
(uint32_t)(1ULL << (32 - tmp_depth));
+ /*
+ * we got to the end of address space
+ * and wrapped around
+ */
+ if (ledge == 0)
+ break;
continue;
}
ret = install_to_fib(dp, ledge, redge,
--
2.34.1
