odp-util: Avoid null dereference in parse_8021q_onward().

For parsing a mask, this code in parse_8021q_onward() always read out
the OVS_KEY_ATTR_VLAN attribute without first checking whether it existed.
The correct behavior, implemented by this commit, appears to be treating
the VLAN as wildcarded and to continue parsing the flow.

Bug #22312.
Reported-by: Krishna Miriyala <miriyalak@vmware.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Justin Pettit <jpettit@nicira.com>

diff --git a/lib/odp-util.c b/lib/odp-util.c
index f44c7d4..18ad5c6 100644 (file)
--- a/lib/odp-util.c
+++ b/lib/odp-util.c
@@ -3035,7 +3035,9 @@ parse_8021q_onward(const struct nlattr *attrs[OVS_KEY_ATTR_MAX + 1],
     if (!is_mask && !(present_attrs & (UINT64_C(1) << OVS_KEY_ATTR_VLAN))) {
         return ODP_FIT_TOO_LITTLE;
     } else {
-        tci = nl_attr_get_be16(attrs[OVS_KEY_ATTR_VLAN]);
+        tci = (present_attrs & (UINT64_C(1) << OVS_KEY_ATTR_VLAN)
+               ? nl_attr_get_be16(attrs[OVS_KEY_ATTR_VLAN])
+               : htons(0));
         if (!is_mask) {
             if (tci == htons(0)) {
                 /* Corner case for a truncated 802.1Q header. */