Fix hash table bogus read in ip6 vxlan-gpe

- consistent use of hash_*_mem methods.
- tunnel setup copies the key from the wrong location
- remove extraneous storage for keys copied from the vxlan
  node that is not applicable here

Change-Id: I419fd30a52ba387104abe467c296de85233823d1
Signed-off-by: Florin Coras <fcoras@cisco.com>
Signed-off-by: Chris Luke <chrisy@flirble.org>

1 files changed, 3 insertions, 8 deletions

diff --git a/vnet/vnet/vxlan-gpe/vxlan_gpe.c b/vnet/vnet/vxlan-gpe/vxlan_gpe.c
index e6565f4379b..2baf182888f 100644
--- a/vnet/vnet/vxlan-gpe/vxlan_gpe.c
+++ b/vnet/vnet/vxlan-gpe/vxlan_gpe.c
@@ -228,7 +228,7 @@ int vnet_vxlan_gpe_add_del_tunnel
     key6.remote.as_u64[1] = a->remote.ip6.as_u64[1];
     key6.vni = clib_host_to_net_u32 (a->vni << 8);
 
-    p = hash_get(gm->vxlan6_gpe_tunnel_by_key, &key6);
+    p = hash_get_mem(gm->vxlan6_gpe_tunnel_by_key, &key6);
   }
   
   if (a->is_add)
@@ -250,11 +250,6 @@ int vnet_vxlan_gpe_add_del_tunnel
       else            foreach_copy_ipv6
 #undef _
 
-      if (a->is_ip6) {
-        /* copy the key */
-        t->key6 = key6;
-      }
-
       if (!a->is_ip6) t->flags |= VXLAN_GPE_TUNNEL_IS_IPV4;
 
       if (!a->is_ip6) {
@@ -279,8 +274,8 @@ int vnet_vxlan_gpe_add_del_tunnel
       else
       {
           key6_copy = clib_mem_alloc (sizeof (*key6_copy));
-          clib_memcpy (key6_copy, &key4, sizeof (*key6_copy));
-          hash_set_mem (gm->vxlan4_gpe_tunnel_by_key, key6_copy,
+          clib_memcpy (key6_copy, &key6, sizeof (*key6_copy));
+          hash_set_mem (gm->vxlan6_gpe_tunnel_by_key, key6_copy,
                         t - gm->tunnels);
       }