ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vlib: fix crash on packet on deleted interface

Browse Source 
If ip4_neighbor_probe (or any other) is sending packet to a deleted interface,
ASSERT trips and dataplane crashes. Example:

create loopback interface instance 0
set interface ip address loop0 10.0.0.1/32
set interface state GigabitEthernet3/0/1 up
set interface state loop0 up
set interface state loop0 down
set interface ip address del loop0 10.0.0.1/32
delete loopback interface intfc loop0
set interface state GigabitEthernet3/0/1 down
set interface state GigabitEthernet3/0/1 up
comment { the following crashes VPP }
set interface state GigabitEthernet3/0/1 down

This sequence reliably crashes VPP:

(gdb)p n->name
$4 = (u8 *) 0x7fff82b47578 "interface-3-output-deleted”

If the interface doesn't exist, return ~0 and be tolerant of this in the
two call sites of counter_index()

Type: fix
Signed-off-by: Pim van Pelt <pim@ipng.nl>
Change-Id: I90ec58fc0d14b20c9822703fe914f2ce89acb18d
This commit is contained in:
Pim van Pelt
2022-06-03 21:05:26 +00:00
committed by Damjan Marion
parent 9cca694c8f
commit 96158834db
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/vlib/drop.c
View File

@@ -74,7 +74,8 @@ counter_index (vlib_main_t * vm, vlib_error_t e)
n = vlib_get_node (vm, ni);
ci = vlib_error_get_code (&vm->node_main, e);
ASSERT (ci < n->n_errors);
if (ci >= n->n_errors)
return CLIB_U32_MAX;
ci += n->error_heap_index;
@@ -94,7 +95,8 @@ format_error_trace (u8 * s, va_list * va)
error_node = vlib_get_node (vm, vlib_error_get_node (&vm->node_main, e[0]));
i = counter_index (vm, vlib_error_get_code (&vm->node_main, e[0])) +
error_node->error_heap_index;
s = format (s, "%v: %s", error_node->name, em->counters_heap[i].name);
if (i != CLIB_U32_MAX)
s = format (s, "%v: %s", error_node->name, em->counters_heap[i].name);
return s;
}
@@ -222,7 +224,8 @@ process_drop_punt (vlib_main_t * vm,
n_left -= count;
c_index = counter_index (vm, error[0]);
em->counters[c_index] += count;
if (c_index != CLIB_U32_MAX)
em->counters[c_index] += count;
vlib_error_elog_count (vm, c_index, count);
}