Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
netdev-native-tnl: Fix use of uninitialized RSS hash.
RSS hash calculation for a packet may be skipped in some cases. One of them is a simple match optimization. Packet is not fully parsed for the simple match, so there is no enough data to calculate the full 5-tuple hash. However, when such a packet needs tunnel encapsulation, we need RSS hash to calculate the source port for the outer UDP header. And netdev_tnl_get_src_port() function doesn't check if the hash is valid before using it. So, such packets will likely end up with different and unpredictable source ports potentially causing packet reordering or other issues in the network: WARNING: MemorySanitizer: use-of-uninitialized-value 0 0x10c129c in dp_packet_get_rss_hash lib/dp-packet.h:1029:5 1 0x10b264c in netdev_tnl_get_src_port lib/netdev-native-tnl.h:131:12 2 0x10b171a in netdev_tnl_push_udp_header lib/netdev-native-tnl.c:286:20 3 0xb772fe in netdev_push_header lib/netdev.c:1037:13 4 0x9673c4 in push_tnl_action lib/dpif-netdev.c:9067:11 5 0x961abe in dp_execute_cb lib/dpif-netdev.c:9226:13 6 0xbcb4b1 in odp_execute_actions lib/odp-execute.c:1008:17 7 0x8e939f in dp_netdev_execute_actions lib/dpif-netdev.c:9524:5 8 0x968f3f in dp_execute_userspace_action lib/dpif-netdev.c:9093:9 9 0x962e54 in dp_execute_cb lib/dpif-netdev.c:9307:17 10 0xbcb4b1 in odp_execute_actions lib/odp-execute.c:1008:17 11 0x8e939f in dp_netdev_execute_actions lib/dpif-netdev.c:9524:5 12 0x950fef in packet_batch_per_flow_execute lib/dpif-netdev.c:8271:5 13 0x8ec8db in dp_netdev_input__ lib/dpif-netdev.c:8899:9 14 0x8eb8ec in dp_netdev_input lib/dpif-netdev.c:8908:5 15 0x92d5e8 in dp_netdev_process_rxq_port lib/dpif-netdev.c:5660:19 16 0x8ee2c4 in dpif_netdev_run lib/dpif-netdev.c:6993:25 17 0x9b442f in dpif_run lib/dpif.c:471:16 18 0x5f8e3a in type_run ofproto/ofproto-dpif.c:367:9 19 0x56c508 in ofproto_type_run ofproto/ofproto.c:1879:31 20 0x4cb388 in bridge_run__ vswitchd/bridge.c:3281:9 21 0x4c9b00 in bridge_run vswitchd/bridge.c:3346:5 22 0x526043 in main vswitchd/ovs-vswitchd.c:130:9 23 0x7f1192 in __libc_start_call_main 24 0x7f1192 in __libc_start_main@GLIBC_2.2.5 25 0x432b24 in _start (vswitchd/ovs-vswitchd+0x432b24) The issue is caught by running the 'debug_slow' test under the memory sanitizer. Another way to reproduce is by sending two packets at once through the datapath. The first one will get the same memory chunk as the upcalled packet with already calculated RSS, the second one will get the brand new memory chunk without the calculated RSS, so these two packets will have different source ports after encapsulation. The test is updated to cover this case. Fix the issue by checking if the hash is valid before using, re-parsing and calculating if it is not. The netdev_tnl_get_src_port() function moved to the .c file, since there is no real reason for it to be in the header. Compiler can decide on inlining it. The declaration kept in the header, since all the other functions declared there, even if there is no reason for that. In the future we may want to consolidate all the places where we re-calculate RSS hash into a single function, but it's a little tricky. This is also a larger change that would be harder to backport. So, not touching that aspect for now. Re-parsing the packet eliminates advantages of the simple match, but it was designed primarily for very simple setups that do not involve tunneling or any other complex processing, so it should not be a big problem. And simple match can still be used with tunneling when the input port provides the RSS hash. Also, checking if the hash is valid is a right thing to do anyways. Next step might be to not use simple match when there is no RSS hash and there is a tunnel push action, but it seems hard to implement, especially since we don't know the actions until we lookup the flow. Fixes: e7e9973 ("dpif-netdev: Forwarding optimization for flows with a simple match.") Signed-off-by: Ilya Maximets <[email protected]>
- Loading branch information