Paul Blakey 1df9d552fe openvswitch: Fix setting ipv6 fields causing hw csum failure ... commit d9b5ae5c1b upstream. Ipv6 ttl, label and tos fields are modified without first pulling/pushing the ipv6 header, which would have updated the hw csum (if available). This might cause csum validation when sending the packet to the stack, as can be seen in the trace below. Fix this by updating skb->csum if available. Trace resulted by ipv6 ttl dec and then sending packet to conntrack [actions: set(ipv6(hlimit=63)),ct(zone=99)]: [295241.900063] s_pf0vf2: hw csum failure [295241.923191] Call Trace: [295241.925728] <IRQ> [295241.927836] dump_stack+0x5c/0x80 [295241.931240] __skb_checksum_complete+0xac/0xc0 [295241.935778] nf_conntrack_tcp_packet+0x398/0xba0 [nf_conntrack] [295241.953030] nf_conntrack_in+0x498/0x5e0 [nf_conntrack] [295241.958344] __ovs_ct_lookup+0xac/0x860 [openvswitch] [295241.968532] ovs_ct_execute+0x4a7/0x7c0 [openvswitch] [295241.979167] do_execute_actions+0x54a/0xaa0 [openvswitch] [295242.001482] ovs_execute_actions+0x48/0x100 [openvswitch] [295242.006966] ovs_dp_process_packet+0x96/0x1d0 [openvswitch] [295242.012626] ovs_vport_receive+0x6c/0xc0 [openvswitch] [295242.028763] netdev_frame_hook+0xc0/0x180 [openvswitch] [295242.034074] __netif_receive_skb_core+0x2ca/0xcb0 [295242.047498] netif_receive_skb_internal+0x3e/0xc0 [295242.052291] napi_gro_receive+0xba/0xe0 [295242.056231] mlx5e_handle_rx_cqe_mpwrq_rep+0x12b/0x250 [mlx5_core] [295242.062513] mlx5e_poll_rx_cq+0xa0f/0xa30 [mlx5_core] [295242.067669] mlx5e_napi_poll+0xe1/0x6b0 [mlx5_core] [295242.077958] net_rx_action+0x149/0x3b0 [295242.086762] __do_softirq+0xd7/0x2d6 [295242.090427] irq_exit+0xf7/0x100 [295242.093748] do_IRQ+0x7f/0xd0 [295242.096806] common_interrupt+0xf/0xf [295242.100559] </IRQ> [295242.102750] RIP: 0033:0x7f9022e88cbd [295242.125246] RSP: 002b:00007f9022282b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffda [295242.132900] RAX: 0000000000000005 RBX: 0000000000000010 RCX: 0000000000000000 [295242.140120] RDX: 00007f9022282ba8 RSI: 00007f9022282a30 RDI: 00007f9014005c30 [295242.147337] RBP: 00007f9014014d60 R08: 0000000000000020 R09: 00007f90254a8340 [295242.154557] R10: 00007f9022282a28 R11: 0000000000000246 R12: 0000000000000000 [295242.161775] R13: 00007f902308c000 R14: 000000000000002b R15: 00007f9022b71f40 Fixes: 3fdbd1ce11 ("openvswitch: add ipv6 'set' action") Signed-off-by: Paul Blakey <paulb@nvidia.com> Link: https://lore.kernel.org/r/20220223163416.24096-1-paulb@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-02 11:42:49 +01:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	9p/net: fix missing error check in p9_check_errors	2021-11-18 14:04:29 +01:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:19:08 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25	ax25: improve the incomplete fix to avoid UAF and NPD bugs	2022-02-23 12:00:59 +01:00
batman-adv	batman-adv: allow netlink usage in unprivileged containers	2022-01-27 10:54:11 +01:00
bluetooth	Bluetooth: refactor malicious adv data check	2022-02-01 17:25:38 +01:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-10-27 09:56:56 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:56:29 +02:00
bridge	net: bridge: vlan: fix memory leak in __allowed_ingress	2022-02-01 17:25:48 +01:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: isotp: add SF_BROADCAST support for functional addressing	2022-02-23 12:00:56 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends	2022-03-02 11:42:49 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 14:04:08 +01:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver	docs: networking: convert dns_resolver.txt to ReST	2020-04-28 14:39:46 -07:00
dsa	net: dsa: don't allocate the slave_mii_bus using devres	2021-09-30 10:11:02 +02:00
ethernet	net: move devres helpers into a separate source file	2020-05-23 16:56:17 -07:00
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-17 10:14:41 +01:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:30:37 +01:00
ife
ipv4	gso: do not skip outer ip header in case of ipip and net_failover	2022-03-02 11:42:49 +01:00
ipv6	gso: do not skip outer ip header in case of ipip and net_failover	2022-03-02 11:42:49 +01:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:27:56 +02:00
l3mdev	net: Fix some comments	2020-08-27 07:55:59 -07:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc	net: llc: fix skb_over_panic	2021-08-04 12:46:43 +02:00
mac80211	mac80211: allow non-standard VHT MCS-10/11	2022-01-27 10:54:19 +01:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:03:23 +01:00
mptcp	mptcp: clear 'kern' flag from fallback sockets	2021-12-22 09:30:54 +01:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:40:32 +01:00
netfilter	netfilter: nf_tables_offload: incorrect flow offload action array size	2022-03-02 11:42:47 +01:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-18 13:40:35 +02:00
netlink	net: netlink: af_netlink: Prevent empty skb by adding a check on len.	2021-12-17 10:14:40 +01:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 10:54:03 +01:00
nfc	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()	2022-01-27 10:53:41 +01:00
nsh	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
openvswitch	openvswitch: Fix setting ipv6 fields causing hw csum failure	2022-03-02 11:42:49 +01:00
packet	af_packet: fix data-race in packet_setsockopt / packet_setsockopt	2022-02-05 12:37:57 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:25:01 +01:00
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	rds: memory leak in __rds_conn_create()	2021-12-22 09:30:54 +01:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Adjust retransmission backoff	2022-02-01 17:25:46 +01:00
sched	net: sched: limit TC_ACT_REPEAT loops	2022-02-23 12:01:07 +01:00
sctp	sctp: use call_rcu to free endpoint	2022-01-05 12:40:30 +01:00
smc	net/smc: Fix hung_task when removing SMC-R devices	2022-01-27 10:54:32 +01:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
sunrpc	xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create	2022-02-23 12:01:06 +01:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: Fix end of loop tests for list_for_each_entry()	2022-03-02 11:42:49 +01:00
tls	net/tls: Fix authentication failure in CCM mode	2021-12-08 09:03:29 +01:00
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 10:54:31 +01:00
vmw_vsock	vsock: remove vsock from connected table when connect is interrupted by a signal	2022-02-23 12:01:01 +01:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	cfg80211: call cfg80211_stop_ap when switch from P2P_GO type	2021-11-26 10:39:20 +01:00
x25	net/x25: Return the correct errno code	2021-06-18 10:00:06 +02:00
xdp	Revert "xsk: Do not sleep in poll() when need_wakeup set"	2021-12-22 09:30:59 +01:00
xfrm	xfrm: Don't accidentally set RTO_ONLINK in decode_session4()	2022-01-27 10:54:33 +01:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c	net: devres: rename the release callback of devm_register_netdev()	2020-06-30 15:57:34 -07:00
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile	net: move devres helpers into a separate source file	2020-05-23 16:56:17 -07:00
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c