The ipv6_label field member of struct ovs_key_ipv6 is 32 bits in size,
but an IPv6 label is only 20 bits, so the upper 12 bits are not writable
and must be 0 in the mask.  The code wasn't careful about this so it could
try to write them anyway.  This commit fixes the problem.

Reported-by: [email protected]
Reported-at: 
https://mail.openvswitch.org/pipermail/ovs-discuss/2018-September/047357.html
Signed-off-by: Ben Pfaff <[email protected]>
---
 lib/odp-util.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/odp-util.c b/lib/odp-util.c
index cf62550bfec2..890c71b7f336 100644
--- a/lib/odp-util.c
+++ b/lib/odp-util.c
@@ -7260,6 +7260,7 @@ commit_set_ipv6_action(const struct flow *flow, struct 
flow *base_flow,
     get_ipv6_key(&wc->masks, &mask, true);
     mask.ipv6_proto = 0;        /* Not writeable. */
     mask.ipv6_frag = 0;         /* Not writable. */
+    mask.ipv6_label &= htonl(IPV6_LABEL_MASK); /* Not writable. */
 
     if (flow_tnl_dst_is_set(&base_flow->tunnel) &&
         ((base_flow->nw_tos ^ flow->nw_tos) & IP_ECN_MASK) == 0) {
-- 
2.16.1

_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to