83 lines
2.6 KiB
Diff
83 lines
2.6 KiB
Diff
From 72f51b097a71fb9bdea13bdd254ff620b34c852e Mon Sep 17 00:00:00 2001
|
|
From: Kumara Parameshwaran <kumaraparamesh92@gmail.com>
|
|
Date: Sun, 16 Oct 2022 20:13:05 +0530
|
|
Subject: [PATCH] gro: check payload length after trim
|
|
|
|
When packet is padded with extra bytes the
|
|
the validation of the payload length should be done
|
|
after the trim operation
|
|
|
|
Fixes: b8a55871d5af ("gro: trim tail padding bytes")
|
|
Cc: stable@dpdk.org
|
|
|
|
Signed-off-by: Kumara Parameshwaran <kumaraparamesh92@gmail.com>
|
|
Acked-by: Jiayu Hu <jiayu.hu@intel.com>
|
|
---
|
|
lib/gro/gro_tcp4.c | 11 ++++++-----
|
|
lib/gro/gro_udp4.c | 10 +++++-----
|
|
2 files changed, 11 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/lib/gro/gro_tcp4.c b/lib/gro/gro_tcp4.c
|
|
index 8f5e800250..0014096e63 100644
|
|
--- a/lib/gro/gro_tcp4.c
|
|
+++ b/lib/gro/gro_tcp4.c
|
|
@@ -225,6 +225,12 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt,
|
|
*/
|
|
if (tcp_hdr->tcp_flags != RTE_TCP_ACK_FLAG)
|
|
return -1;
|
|
+
|
|
+ /* trim the tail padding bytes */
|
|
+ ip_tlen = rte_be_to_cpu_16(ipv4_hdr->total_length);
|
|
+ if (pkt->pkt_len > (uint32_t)(ip_tlen + pkt->l2_len))
|
|
+ rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_tlen - pkt->l2_len);
|
|
+
|
|
/*
|
|
* Don't process the packet whose payload length is less than or
|
|
* equal to 0.
|
|
@@ -233,11 +239,6 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt,
|
|
if (tcp_dl <= 0)
|
|
return -1;
|
|
|
|
- /* trim the tail padding bytes */
|
|
- ip_tlen = rte_be_to_cpu_16(ipv4_hdr->total_length);
|
|
- if (pkt->pkt_len > (uint32_t)(ip_tlen + pkt->l2_len))
|
|
- rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_tlen - pkt->l2_len);
|
|
-
|
|
/*
|
|
* Save IPv4 ID for the packet whose DF bit is 0. For the packet
|
|
* whose DF bit is 1, IPv4 ID is ignored.
|
|
diff --git a/lib/gro/gro_udp4.c b/lib/gro/gro_udp4.c
|
|
index 839f9748b7..42596d33b6 100644
|
|
--- a/lib/gro/gro_udp4.c
|
|
+++ b/lib/gro/gro_udp4.c
|
|
@@ -220,6 +220,11 @@ gro_udp4_reassemble(struct rte_mbuf *pkt,
|
|
if (!is_ipv4_fragment(ipv4_hdr))
|
|
return -1;
|
|
|
|
+ ip_dl = rte_be_to_cpu_16(ipv4_hdr->total_length);
|
|
+ /* trim the tail padding bytes */
|
|
+ if (pkt->pkt_len > (uint32_t)(ip_dl + pkt->l2_len))
|
|
+ rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_dl - pkt->l2_len);
|
|
+
|
|
/*
|
|
* Don't process the packet whose payload length is less than or
|
|
* equal to 0.
|
|
@@ -227,14 +232,9 @@ gro_udp4_reassemble(struct rte_mbuf *pkt,
|
|
if (pkt->pkt_len <= hdr_len)
|
|
return -1;
|
|
|
|
- ip_dl = rte_be_to_cpu_16(ipv4_hdr->total_length);
|
|
if (ip_dl <= pkt->l3_len)
|
|
return -1;
|
|
|
|
- /* trim the tail padding bytes */
|
|
- if (pkt->pkt_len > (uint32_t)(ip_dl + pkt->l2_len))
|
|
- rte_pktmbuf_trim(pkt, pkt->pkt_len - ip_dl - pkt->l2_len);
|
|
-
|
|
ip_dl -= pkt->l3_len;
|
|
ip_id = rte_be_to_cpu_16(ipv4_hdr->packet_id);
|
|
frag_offset = rte_be_to_cpu_16(ipv4_hdr->fragment_offset);
|
|
--
|
|
2.23.0
|
|
|