tunneling: Don't send ICMP messages if no tunnel port is found.
authorJesse Gross <jesse@nicira.com>
Fri, 1 Feb 2013 23:34:10 +0000 (15:34 -0800)
committerJesse Gross <jesse@nicira.com>
Sat, 2 Feb 2013 01:22:01 +0000 (17:22 -0800)
commitdc7b1abfdb88f099050cc4335f3dd3436a856b5d
tree5a9e1ff95b8d75e690d169087324f4896afc74af
parentb93bd611bd4217b6cf21c657c1402a739131a44b
tunneling: Don't send ICMP messages if no tunnel port is found.

Some tunnel code in OVS (for example, CAPWAP) uses the skb->cb to
store information while processing packets.  However, if we don't
find an appropriate tunnel port on receive, then we send an ICMP
port unreachable message, which calls back into the IP stack.  The
stack assumes that skb->cb will still contain valid information
about from the IP layer, including any IP options.  As a result,
icmp_echo_options() can read the garbage values from OVS and
overwrite data on the stack, panicing the machine.

This simply stops sending ICMP messages when ports are not found.
Many people find them confusing and flow based tunneling will
never send them (since it always finds a port) so it solves both
problems at once.

Bug #14880

Reported-by: Deepesh Govindan <dgovindan@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Kyle Mestery <kmestery@cisco.com>
Conflicts:

datapath/vport-vxlan.c
datapath/vport-capwap.c
datapath/vport-gre.c