When I try to dump BPF map, ovs-vswitchd gets SIGSEGV. As a result ovs-vswitchd is terminated.

To trigger this issue, I need to do following steps:

Create test environment - two pairs of interfaces with type veth:


$ ip netns add test0
$ ip link add port0 type veth peer name peer0
$ ip link set port0 netns test0
$ ip link set peer0 up

$ ip netns exec test0 sh << EOF ip addr add "10.1.1.1/24" dev port0 ip link set port0 up EOF

$ ip netns add test1 $ ip link add port1 type veth peer name peer1 $ ip link set port1 netns test1 $ ip link set peer1 up

$ ip netns exec test1 sh << EOF ip addr add "10.1.1.2/24" dev port1 ip link set port1 up EOF


2. Create OVS switch with ports of type `afxdp`:

$ sudo ovs-vsctl -- add-br br0 -- set Bridge br0 datapath_type=netdev $ sudo ovs-vsctl add-port br0 peer0 -- set interface peer0 type="afxdp" $ sudo ovs-vsctl add-port br0 peer1 -- set interface peer1 type="afxdp"


3. Load uBPF program into switch and insert data into (any) map:

$ sudo ovs-ofctl load-bpf-prog br0 1 tunneling.o $ sudo ovs-ofctl show-bpf-prog br0 NXT_BPF_SHOW_PROG_REPLY (xid=0x4): The number of BPF programs already loaded: 1 id 1: loaded_at=2020-03-07 T23:00:43 map_ids 0,1 $ sudo ovs-ofctl update-bpf-map br0 1 1 key 14 0 16 172 value 0 0 0 0

I used [tunneling.p4](https://github.com/P4-Research/p4c/blob/master/backends/ubpf/tests/testdata/test-tunneling.p4) as a uBPF program.

4. Dump content of the map:

$ sudo ovs-ofctl dump-bpf-map br0 1 1 hex ovs-ofctl: talking to unix:/usr/local/var/run/openvswitch/br0.mgmt (End of file)


As the result in the terminal, where ovs-vswitchd has been run, I got following logs:

2020-03-07T21:59:02Z|00051|memory|INFO|handlers:1 ports:3 revalidators:1 rules:5 Segmentation fault (core dumped)


When I repeat this scenario with gdb, I got following logs for ovs-vswitchd:

2020-03-08T14:33:57Z|00049|memory|INFO|handlers:1 ports:3 revalidators:1 rules:5

Thread 1 "ovs-vswitchd" received signal SIGSEGV, Segmentation fault. 0x0000555555932d90 in ofpmsg_update_length (buf=buf@entry=0x8ec40) at lib/ofp-msgs.c:884 884 struct ofp_header oh = ofpbuf_at_assert(buf, 0, sizeof oh); (gdb) bt

0 0x0000555555932d90 in ofpmsg_update_length (buf=buf@entry=0x8ec40)

at lib/ofp-msgs.c:884

1 0x0000555555787783 in ofconn_send (ofconn=0x613000001000,

counter=0x60600008e100, msg=0x8ec40) at ofproto/connmgr.c:1489

2 ofconn_send_reply (ofconn=ofconn@entry=0x613000001000, msg=0x8ec40)

at ofproto/connmgr.c:1026

3 0x00005555556e08f4 in handle_dump_map (oh=,

ofconn=0x613000001000) at ofproto/ofproto.c:6525

4 handle_single_part_openflow (type=, oh=,

ofconn=0x613000001000) at ofproto/ofproto.c:8892

5 handle_openflow (ofconn=ofconn@entry=0x613000001000,

msgs=msgs@entry=0x7fffffffd280) at ofproto/ofproto.c:9077

6 0x0000555555787f33 in ofconn_run (

handle_openflow=0x5555556d9b80 <handle_openflow>, ofconn=0x613000001000)
at ofproto/connmgr.c:1321

7 connmgr_run (mgr=,

handle_openflow=handle_openflow@entry=0x5555556d9b80 <handle_openflow>)
at ofproto/connmgr.c:356

8 0x00005555556c5f47 in ofproto_run (p=)

at ofproto/ofproto.c:1894

9 0x000055555568ae16 in bridge_run__ () at vswitchd/bridge.c:3246

10 0x000055555569de55 in bridge_run () at vswitchd/bridge.c:3305

11 0x000055555567d934 in main (argc=, argv=)

at vswitchd/ovs-vswitchd.c:127

Orange-OpenSource / p4rt-ovs

Segmentation fault in ovs-vswitchd during dump-bpf-map #9