On Fri, Dec 17, 2021 at 4:30 PM Dumitru Ceara <[email protected]> wrote:
>
> UB Sanitizer report:
>   lib/actions.c:1849:23: runtime error: member access within misaligned 
> address 0x000002cefc83 for type 'struct controller_event_opt_header', which 
> requires 2 byte alignment
>   0x000002cefc83: note: pointer points here
>    31  3a 38 30 5a 5a 5a 5a 5a  5a 5a 5a 5a 5a 5a 5a 5a  57 30 2c 20 70 72 00 
> 07  41 00 00 00 00 00 00
>                 ^
>       #0 0x457034 in encode_event_empty_lb_backends_opts lib/actions.c:1849
>       #1 0x4573fa in encode_TRIGGER_EVENT lib/actions.c:1873
>       #2 0x46b95d in ovnact_encode lib/actions.c:4263
>       #3 0x46bb23 in ovnacts_encode lib/actions.c:4281
>       [...]
>
> Signed-off-by: Dumitru Ceara <[email protected]>


Acked-by: Numan Siddique <[email protected]>

Numan

> ---
>  controller/pinctrl.c |   11 +++++++----
>  lib/actions.c        |   25 +++++++++++++------------
>  2 files changed, 20 insertions(+), 16 deletions(-)
>
> diff --git a/controller/pinctrl.c b/controller/pinctrl.c
> index e0dc1e094..87e1cc2d0 100644
> --- a/controller/pinctrl.c
> +++ b/controller/pinctrl.c
> @@ -6113,23 +6113,26 @@ wait_controller_event(struct ovsdb_idl_txn 
> *ovnsb_idl_txn)
>  static bool
>  pinctrl_handle_empty_lb_backends_opts(struct ofpbuf *userdata)
>  {
> -    struct controller_event_opt_header *userdata_opt;
> +    struct controller_event_opt_header opt_hdr;
> +    void *userdata_opt;
>      uint32_t hash = 0;
>      char *vip = NULL;
>      char *protocol = NULL;
>      char *load_balancer = NULL;
>
>      while (userdata->size) {
> -        userdata_opt = ofpbuf_try_pull(userdata, sizeof *userdata_opt);
> +        userdata_opt = ofpbuf_try_pull(userdata, sizeof opt_hdr);
>          if (!userdata_opt) {
>              return false;
>          }
> -        size_t size = ntohs(userdata_opt->size);
> +        memcpy(&opt_hdr, userdata_opt, sizeof opt_hdr);
> +
> +        size_t size = ntohs(opt_hdr.size);
>          char *userdata_opt_data = ofpbuf_try_pull(userdata, size);
>          if (!userdata_opt_data) {
>              return false;
>          }
> -        switch (ntohs(userdata_opt->opt_code)) {
> +        switch (ntohs(opt_hdr.opt_code)) {
>          case EMPTY_LB_VIP:
>              vip = xmemdup0(userdata_opt_data, size);
>              break;
> diff --git a/lib/actions.c b/lib/actions.c
> index da00ee349..a78d01198 100644
> --- a/lib/actions.c
> +++ b/lib/actions.c
> @@ -1842,19 +1842,20 @@ encode_event_empty_lb_backends_opts(struct ofpbuf 
> *ofpacts,
>  {
>      for (const struct ovnact_gen_option *o = event->options;
>           o < &event->options[event->n_options]; o++) {
> -        struct controller_event_opt_header *hdr =
> -            ofpbuf_put_uninit(ofpacts, sizeof *hdr);
> +
> +        /* All empty_lb_backends fields are of type 'str' */
> +        ovs_assert(!strcmp(o->option->type, "str"));
> +
>          const union expr_constant *c = o->value.values;
> -        size_t size;
> -        hdr->opt_code = htons(o->option->code);
> -        if (!strcmp(o->option->type, "str")) {
> -            size = strlen(c->string);
> -            hdr->size = htons(size);
> -            ofpbuf_put(ofpacts, c->string, size);
> -        } else {
> -            /* All empty_lb_backends fields are of type 'str' */
> -            OVS_NOT_REACHED();
> -        }
> +        size_t size = strlen(c->string);
> +        struct controller_event_opt_header hdr =
> +            (struct controller_event_opt_header) {
> +            .opt_code = htons(o->option->code),
> +            .size = htons(size),
> +        };
> +
> +        memcpy(ofpbuf_put_uninit(ofpacts, sizeof hdr), &hdr, sizeof hdr);
> +        ofpbuf_put(ofpacts, c->string, size);
>      }
>  }
>
>
> _______________________________________________
> dev mailing list
> [email protected]
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to