X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=datapath%2Fdatapath.c;h=5ce77cd3485cf6e80afe36c8ad683b40bcfc8ed5;hb=280c6e99fd5fcdaff5af6990f0c346d113d90cde;hp=dcff05f2986dbc23749c01063eb47ce3f10b120c;hpb=088a727c9ca2a9b54e11de94e1fc4396a277523a;p=sliver-openvswitch.git

diff --git a/datapath/datapath.c b/datapath/datapath.c
index dcff05f29..5ce77cd34 100644
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -359,7 +359,6 @@ static void copy_and_csum_skb(struct sk_buff *skb, void *to)
 
 	get_skb_csum_pointers(skb, &csum_start, &csum_offset);
 	csum_start -= skb_headroom(skb);
-	BUG_ON(csum_start >= skb_headlen(skb));
 
 	skb_copy_bits(skb, 0, to, csum_start);
 
@@ -441,7 +440,11 @@ int dp_upcall(struct datapath *dp, struct sk_buff *skb, const struct dp_upcall_i
 		}
 	}
 
-	return queue_control_packets(dp, skb, upcall_info);
+	err = queue_control_packets(dp, skb, upcall_info);
+	if (err)
+		goto err;
+
+	return 0;
 
 err_kfree_skb:
 	kfree_skb(skb);
@@ -488,6 +491,9 @@ static int queue_control_packets(struct datapath *dp, struct sk_buff *skb,
 		if (unlikely(err))
 			goto err_kfree_skbs;
 
+		if (nla_attr_size(skb->len) > USHRT_MAX)
+			goto err_kfree_skbs;
+
 		len = sizeof(struct odp_header);
 		len += nla_total_size(skb->len);
 		len += nla_total_size(FLOW_BUFSIZE);
@@ -676,23 +682,26 @@ static int odp_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
 	struct datapath *dp;
 	struct ethhdr *eth;
 	bool is_frag;
+	int len;
 	int err;
 
 	err = -EINVAL;
 	if (!a[ODP_PACKET_ATTR_PACKET] || !a[ODP_PACKET_ATTR_ACTIONS] ||
 	    nla_len(a[ODP_PACKET_ATTR_PACKET]) < ETH_HLEN)
-		goto exit;
+		goto err;
 
 	err = validate_actions(a[ODP_PACKET_ATTR_ACTIONS]);
 	if (err)
-		goto exit;
+		goto err;
 
-	packet = skb_clone(skb, GFP_KERNEL);
+	len = nla_len(a[ODP_PACKET_ATTR_PACKET]);
+	packet = __dev_alloc_skb(NET_IP_ALIGN + len, GFP_KERNEL);
 	err = -ENOMEM;
 	if (!packet)
-		goto exit;
-	packet->data = nla_data(a[ODP_PACKET_ATTR_PACKET]);
-	packet->len = nla_len(a[ODP_PACKET_ATTR_PACKET]);
+		goto err;
+	skb_reserve(packet, NET_IP_ALIGN);
+
+	memcpy(__skb_put(packet, len), nla_data(a[ODP_PACKET_ATTR_PACKET]), len);
 
 	skb_reset_mac_header(packet);
 	eth = eth_hdr(packet);
@@ -705,29 +714,29 @@ static int odp_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
 	else
 		packet->protocol = htons(ETH_P_802_2);
 
+	/* Initialize OVS_CB (it came from Netlink so might not be zeroed). */
+	memset(OVS_CB(packet), 0, sizeof(struct ovs_skb_cb));
+
 	err = flow_extract(packet, -1, &key, &is_frag);
 	if (err)
-		goto exit;
-
-	/* Initialize OVS_CB (it came from Netlink so might not be zeroed). */
-	OVS_CB(packet)->vport = NULL;
-	OVS_CB(packet)->flow = NULL;
-	/* execute_actions() will reset tun_id to 0 anyhow. */
-#ifdef NEED_CSUM_NORMALIZE
-	OVS_CB(packet)->ip_summed = OVS_CSUM_NONE;
-#endif
-	vlan_copy_skb_tci(packet);
+		goto err_kfree_skb;
 
 	rcu_read_lock();
 	dp = get_dp(odp_header->dp_ifindex);
 	err = -ENODEV;
-	if (dp)
-		err = execute_actions(dp, packet, &key,
-				      nla_data(a[ODP_PACKET_ATTR_ACTIONS]),
-				      nla_len(a[ODP_PACKET_ATTR_ACTIONS]));
+	if (!dp)
+		goto err_unlock;
+	err = execute_actions(dp, packet, &key,
+			      nla_data(a[ODP_PACKET_ATTR_ACTIONS]),
+			      nla_len(a[ODP_PACKET_ATTR_ACTIONS]));
 	rcu_read_unlock();
+	return err;
 
-exit:
+err_unlock:
+	rcu_read_unlock();
+err_kfree_skb:
+	kfree_skb(packet);
+err:
 	return err;
 }
 
@@ -1304,7 +1313,7 @@ static int odp_dp_cmd_validate(struct nlattr *a[ODP_DP_ATTR_MAX + 1])
 			return -EINVAL;
 	}
 
-	return VERIFY_NUL_STRING(a[ODP_DP_ATTR_NAME], IFNAMSIZ - 1);
+	return CHECK_NUL_STRING(a[ODP_DP_ATTR_NAME], IFNAMSIZ - 1);
 }
 
 /* Called with genl_mutex and optionally with RTNL lock also. */
@@ -1456,12 +1465,20 @@ static int odp_dp_cmd_del(struct sk_buff *skb, struct genl_info *info)
 	list_del(&dp->list_node);
 	dp_detach_port(get_vport_protected(dp, ODPP_LOCAL));
 
+	/* rtnl_unlock() will wait until all the references to devices that
+	 * are pending unregistration have been dropped.  We do it here to
+	 * ensure that any internal devices (which contain DP pointers) are
+	 * fully destroyed before freeing the datapath.
+	 */
+	rtnl_unlock();
+
 	call_rcu(&dp->rcu, destroy_dp_rcu);
 	module_put(THIS_MODULE);
 
 	genl_notify(reply, genl_info_net(info), info->snd_pid,
 		    dp_datapath_multicast_group.id, info->nlhdr, GFP_KERNEL);
-	err = 0;
+
+	return 0;
 
 exit_unlock:
 	rtnl_unlock();
@@ -1666,7 +1683,7 @@ static struct sk_buff *odp_vport_cmd_build_info(struct vport *vport, u32 pid,
 
 static int odp_vport_cmd_validate(struct nlattr *a[ODP_VPORT_ATTR_MAX + 1])
 {
-	return VERIFY_NUL_STRING(a[ODP_VPORT_ATTR_NAME], IFNAMSIZ - 1);
+	return CHECK_NUL_STRING(a[ODP_VPORT_ATTR_NAME], IFNAMSIZ - 1);
 }
 
 /* Called with RTNL lock or RCU read lock. */