ofproto-dpif-xlate: Fix crash when using multicast snooping.

The revalidator thread may set may_learn and call xlate_actions with no packet
data. If the revalidated flow is IGMPv3 or MLD, vswitchd will crash when trying
to access the NULL packet.

Only process IGMP and MLD flows when there is a packet. This is a similar
behavior than what we have for other special packets.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Reported-by: Yi Ba <yby.developer@yahoo.com>
Reported-at: http://openvswitch.org/pipermail/discuss/2016-January/020023.html
Fixes: 06994f879c9d ("mcast-snooping: Add Multicast Listener Discovery support")
Signed-off-by: Ben Pfaff <blp@ovn.org>

diff --git a/AUTHORS b/AUTHORS
index 936394d..366b72f 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -412,6 +412,7 @@ Vishal Swarankar        vishal.swarnkar@gmail.com
 Vjekoslav Brajkovic     balkan@cs.washington.edu
 Voravit T.              voravit@kth.se
 Yeming Zhao             zhaoyeming@gmail.com
 Vjekoslav Brajkovic     balkan@cs.washington.edu
 Voravit T.              voravit@kth.se
 Yeming Zhao             zhaoyeming@gmail.com

+Yi Ba                   yby.developer@yahoo.com

 Ying Chen               yingchen@vmware.com
 Yongqiang Liu           liuyq7809@gmail.com
 ZHANG Zhiming           zhangzhiming@yunshan.net.cn
 Ying Chen               yingchen@vmware.com
 Yongqiang Liu           liuyq7809@gmail.com
 ZHANG Zhiming           zhangzhiming@yunshan.net.cn

diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c
index 3dd4ae2..c1e9834 100644 (file)
--- a/ofproto/ofproto-dpif-xlate.c
+++ b/ofproto/ofproto-dpif-xlate.c
@@ -2451,7 +2451,7 @@ xlate_normal(struct xlate_ctx *ctx)
         if (is_igmp(flow)) {
             if (mcast_snooping_is_membership(flow->tp_src) ||
                 mcast_snooping_is_query(flow->tp_src)) {
         if (is_igmp(flow)) {
             if (mcast_snooping_is_membership(flow->tp_src) ||
                 mcast_snooping_is_query(flow->tp_src)) {

-                if (ctx->xin->may_learn) {
+                if (ctx->xin->may_learn && ctx->xin->packet) {

                     update_mcast_snooping_table(ctx->xbridge, flow, vlan,
                                                 in_xbundle, ctx->xin->packet);
                 }
                     update_mcast_snooping_table(ctx->xbridge, flow, vlan,
                                                 in_xbundle, ctx->xin->packet);
                 }


@@ -2483,7 +2483,7 @@ xlate_normal(struct xlate_ctx *ctx)
             return;
         } else if (is_mld(flow)) {
             ctx->xout->slow |= SLOW_ACTION;
             return;
         } else if (is_mld(flow)) {
             ctx->xout->slow |= SLOW_ACTION;

-            if (ctx->xin->may_learn) {
+            if (ctx->xin->may_learn && ctx->xin->packet) {

                 update_mcast_snooping_table(ctx->xbridge, flow, vlan,
                                             in_xbundle, ctx->xin->packet);
             }
                 update_mcast_snooping_table(ctx->xbridge, flow, vlan,
                                             in_xbundle, ctx->xin->packet);
             }