On Wed, Jul 13, 2022 at 04:35:31PM +0200, Ilya Maximets wrote:
> calc_offsets() function returns 'data' and 'mask' pointers, which
> are pointers somewhere inside struct tc_flower_key, and they are not
> aligned, causing misaligned memory access. For example:
>
> ipv6.rewrite_hlimit is at 148 byte offset inside the struct
> tc_flower_key. While the actual field is in the 7th byte of
> the IPv6 header in the actual packet. So, pedit will need
> to write the last byte of the [4-7] range to the actual packet.
> So, data pointer is positioned to 145th byte inside the tc_flower_key
> with the 000000FF mask. Obviously, 145th byte inside the structure
> is not 4-byte aligned.
>
> lib/tc.c:2879:34: runtime error:
> load of misaligned address 0x7f2802eaa321 for type 'ovs_be32' (aka
> 'unsigned int'), which requires 4 byte alignment
> 0x7f2802eaa321: note: pointer points here
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
> ^
> 0 0xd7f2fb in nl_msg_put_flower_rewrite_pedits lib/tc.c:2879:34
> 1 0xd7f2fb in nl_msg_put_flower_acts lib/tc.c:3141:25
> 2 0xd6ae5a in nl_msg_put_flower_options lib/tc.c:3445:12
> 3 0xd6a2be in tc_replace_flower lib/tc.c:3712:17
> 4 0xd2bf25 in netdev_tc_flow_put lib/netdev-offload-tc.c:2224:11
> 5 0x94f6b7 in netdev_flow_put lib/netdev-offload.c:316:14
> 6 0xcbd19e in parse_flow_put lib/dpif-netlink.c:2289:11
> 7 0xcbd19e in try_send_to_netdev lib/dpif-netlink.c:2376:15
> 8 0xcbd19e in dpif_netlink_operate lib/dpif-netlink.c:2447:23
> 9 0x86536e in dpif_operate lib/dpif.c:1372:13
> 10 0x6bc289 in handle_upcalls ofproto/ofproto-dpif-upcall.c:1654:5
> 11 0x6bc289 in recv_upcalls ofproto/ofproto-dpif-upcall.c:892:9
> 12 0x6b766a in udpif_upcall_handler ofproto/ofproto-dpif-upcall.c:792:13
> 13 0xb5015a in ovsthread_wrapper lib/ovs-thread.c:422:12
> 14 0x7f280b2081ce in start_thread (/lib64/libpthread.so.0+0x81ce)
> 15 0x7f2809e39dd2 in clone (/lib64/libc.so.6+0x39dd2)
>
> Fix misaligned read by using appropriate functions.
>
> Fixes: 8ada482bbe19 ("tc: Add header rewrite using tc pedit action")
> Signed-off-by: Ilya Maximets <[email protected]>
Acked-by: Simon Horman <[email protected]>
I'd also be happy to apply this patch if that was your intention.
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
