github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 13:37:36 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
981,961 Commits 1 Branch 933 Tags 20 GiB
C 97%
Assembly 1%
Shell 0.6%
Rust 0.5%
Python 0.4%
Other 0.3%
5ae05b5eb5
Go to file
Ilya Maximets 5ae05b5eb5 net: openvswitch: fix leak of nested actions 
[ Upstream commit 1f30fb9166 ]

While parsing user-provided actions, openvswitch module may dynamically
allocate memory and store pointers in the internal copy of the actions.
So this memory has to be freed while destroying the actions.

Currently there are only two such actions: ct() and set().  However,
there are many actions that can hold nested lists of actions and
ovs_nla_free_flow_actions() just jumps over them leaking the memory.

For example, removal of the flow with the following actions will lead
to a leak of the memory allocated by nf_ct_tmpl_alloc():

  actions:clone(ct(commit),0)

Non-freed set() action may also leak the 'dst' structure for the
tunnel info including device references.

Under certain conditions with a high rate of flow rotation that may
cause significant memory leak problem (2MB per second in reporter's
case).  The problem is also hard to mitigate, because the user doesn't
have direct control over the datapath flows generated by OVS.

Fix that by iterating over all the nested actions and freeing
everything that needs to be freed recursively.

New build time assertion should protect us from this problem if new
actions will be added in the future.

Unfortunately, openvswitch module doesn't use NLA_F_NESTED, so all
attributes has to be explicitly checked.  sample() and clone() actions
are mixing extra attributes into the user-provided action list.  That
prevents some code generalization too.

Fixes: 34ae932a40 ("openvswitch: Make tunnel set action attach a metadata dst")
Link: https://mail.openvswitch.org/pipermail/ovs-dev/2022-March/392922.html
Reported-by: Stéphane Graber <stgraber@ubuntu.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Aaron Conole <aconole@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-13 21:01:06 +02:00
arch parisc: Fix patch code locking and flushing 2022-04-13 21:01:03 +02:00
block Revert "Revert "block, bfq: honor already-setup queue merges"" 2022-04-08 14:40:32 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:50:29 +02:00
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-08 14:39:59 +02:00
Documentation docs: sysctl/kernel: add missing bit to panic_print 2022-04-08 14:40:44 +02:00
drivers ice: synchronize_rcu() when terminating rings 2022-04-13 21:01:05 +02:00
fs NFSv4: fix open failure with O_ACCMODE flag 2022-04-13 21:01:04 +02:00
include NFS: nfsiod should not block forever in mempool_alloc() 2022-04-13 21:01:03 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-13 21:01:01 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:19:10 +01:00
kernel bpf: Adjust BPF stack helper functions to accommodate skip > 0 2022-04-08 14:40:43 +02:00
lib XArray: Update the LRU list in xas_split() 2022-04-08 14:40:40 +02:00
LICENSES
mm mm: fix race between MADV_FREE reclaim and blkdev direct IO read 2022-04-13 21:01:03 +02:00
net net: openvswitch: fix leak of nested actions 2022-04-13 21:01:06 +02:00
samples samples/bpf, xdpsock: Fix race when running for fix duration of time 2022-04-08 14:40:21 +02:00
scripts gcc-plugins/stackleak: Exactly match strings instead of prefixes 2022-04-08 14:40:30 +02:00
security Fix incorrect type in assignment of ipv6 port for audit 2022-04-08 14:40:31 +02:00
sound ASoC: topology: Allow TLV control to be either read or write 2022-04-08 14:40:44 +02:00
tools libbpf: Fix build issue with llvm-readelf 2022-04-13 21:00:56 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:25:48 +01:00
virt KVM: Prevent module exit until all VMs are freed 2022-04-08 14:40:38 +02:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore kbuild: generate Module.symvers only when vmlinux exists 2021-05-19 10:12:59 +02:00
.mailmap mailmap: add two more addresses of Uwe Kleine-König 2020-12-06 10:19:07 -08:00
COPYING
CREDITS MAINTAINERS: Move Jason Cooper to CREDITS 2020-11-30 10:20:34 +01:00
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal 2021-12-14 11:32:46 +01:00
Makefile Linux 5.10.110 2022-04-08 14:40:45 +02:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.