From 72f51b097a71fb9bdea13bdd254ff620b34c852e Mon Sep 17 00:00:00 2001 From: Kumara Parameshwaran Date: Sun, 16 Oct 2022 20:13:05 +0530 Subject: [PATCH] gro: check payload length after trim When packet is padded with extra bytes the the validation of the payload length should be done after the trim operation Fixes: b8a55871d5af ("gro: trim tail padding bytes") Cc: stable@dpdk.org Signed-off-by: Kumara Parameshwaran Acked-by: Jiayu Hu --- lib/gro/gro_tcp4.c | 11 ++++++----- lib/gro/gro_udp4.c | 10 +++++----- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/lib/gro/gro_tcp4.c b/lib/gro/gro_tcp4.c index 8f5e800250..0014096e63 100644 --- a/lib/gro/gro_tcp4.c +++ b/lib/gro/gro_tcp4.c @@ -225,6 +225,12 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt, */ if (tcp_hdr->tcp_flags != RTE_TCP_ACK_FLAG) return -1; + + /* trim the tail padding bytes */ + ip_tlen = rte_be_to_cpu_16(ipv4_hdr->total_length); + if (pkt->pkt_len > (uint32_t)(ip_tlen + pkt->l2_len)) + rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_tlen - pkt->l2_len); + /* * Don't process the packet whose payload length is less than or * equal to 0. @@ -233,11 +239,6 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt, if (tcp_dl <= 0) return -1; - /* trim the tail padding bytes */ - ip_tlen = rte_be_to_cpu_16(ipv4_hdr->total_length); - if (pkt->pkt_len > (uint32_t)(ip_tlen + pkt->l2_len)) - rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_tlen - pkt->l2_len); - /* * Save IPv4 ID for the packet whose DF bit is 0. For the packet * whose DF bit is 1, IPv4 ID is ignored. diff --git a/lib/gro/gro_udp4.c b/lib/gro/gro_udp4.c index 839f9748b7..42596d33b6 100644 --- a/lib/gro/gro_udp4.c +++ b/lib/gro/gro_udp4.c @@ -220,6 +220,11 @@ gro_udp4_reassemble(struct rte_mbuf *pkt, if (!is_ipv4_fragment(ipv4_hdr)) return -1; + ip_dl = rte_be_to_cpu_16(ipv4_hdr->total_length); + /* trim the tail padding bytes */ + if (pkt->pkt_len > (uint32_t)(ip_dl + pkt->l2_len)) + rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_dl - pkt->l2_len); + /* * Don't process the packet whose payload length is less than or * equal to 0. @@ -227,14 +232,9 @@ gro_udp4_reassemble(struct rte_mbuf *pkt, if (pkt->pkt_len <= hdr_len) return -1; - ip_dl = rte_be_to_cpu_16(ipv4_hdr->total_length); if (ip_dl <= pkt->l3_len) return -1; - /* trim the tail padding bytes */ - if (pkt->pkt_len > (uint32_t)(ip_dl + pkt->l2_len)) - rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_dl - pkt->l2_len); - ip_dl -= pkt->l3_len; ip_id = rte_be_to_cpu_16(ipv4_hdr->packet_id); frag_offset = rte_be_to_cpu_16(ipv4_hdr->fragment_offset); -- 2.23.0