github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.4-rc1
linux/net/openvswitch
History
Eric Dumazet b55e5a0159 openvswitch: use eth_type_trans_careful() in internal_dev_recv() 
OVS actions like pop_eth followed by pop_mpls(ETH_P_TEB) or pop_nsh
can expose an inner Ethernet header which is not in the linear part
of the skb. Output to an internal port then crashes in eth_type_trans():

  flow: in_port(0),eth(),eth_type(0x8847),mpls(lse=0x00010140)
  actions: pop_eth,pop_mpls(0x6558),0
  # AF_PACKET SOCK_RAW on dp0: eth / mpls / eth / 4096 bytes of payload

  kernel BUG at include/linux/skbuff.h:2839!
  RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
  Call Trace:
   internal_dev_recv (net/openvswitch/vport-internal_dev.c:202) openvswitch
   do_execute_actions (net/openvswitch/actions.c:1296) openvswitch
   ovs_execute_actions (net/openvswitch/actions.c:1606) openvswitch
   ovs_dp_process_packet (net/openvswitch/datapath.c:310) openvswitch
   ovs_vport_receive (net/openvswitch/vport.c:448) openvswitch
   internal_dev_xmit (net/openvswitch/vport-internal_dev.c:42) openvswitch
   dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
   __dev_queue_xmit (net/core/dev.c:5066)
   packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)

Use eth_type_trans_careful(), and drop the packet if the Ethernet
header can not be pulled. This covers all OVS actions at the consumer,
instead of fixing each producer.

Fixes: b2d0f5d5dc ("openvswitch: enable NSH support")
Fixes: f66b53fdbb ("openvswitch: New MPLS actions for layer 2 tunnelling")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261028122703.2093730-5-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-29 09:11:21 -07:00
..
actions.c net: openvswitch: drop IP fragments on SCTP set action 2026-10-20 11:46:20 -07:00
conntrack.c net: openvswitch: conntrack: fix helper UAF due to extensions realloc 2026-09-24 09:56:01 -07:00
conntrack.h openvswitch: Fix CT limit teardown use-after-free 2026-08-24 11:38:09 -07:00
datapath.c net: gso: support re-segmentation of TCP GSO skbs 2026-10-13 15:32:47 +02:00
datapath.h net: openvswitch: don't schedule rebalancing if there are no datapaths 2026-09-03 17:46:43 -07:00
dp_notify.c
drop.h
flow_netlink.c net: drop unused LLC-related includes 2026-10-01 10:07:32 +02:00
flow_netlink.h
flow_table.c net: drop unused LLC-related includes 2026-10-01 10:07:32 +02:00
flow_table.h
flow.c net: drop unused LLC-related includes 2026-10-01 10:07:32 +02:00
flow.h
Kconfig openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
Makefile openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
meter.c net: openvswitch: fix potential UAF on meter attach failure 2026-07-30 13:20:03 +02:00
meter.h
openvswitch_trace.c
openvswitch_trace.h
vport-internal_dev.c openvswitch: use eth_type_trans_careful() in internal_dev_recv() 2026-10-29 09:11:21 -07:00
vport-internal_dev.h
vport-netdev.c net: drop unused LLC-related includes 2026-10-01 10:07:32 +02:00
vport-netdev.h openvswitch: remove support for legacy tunnel types 2026-08-06 15:09:23 +02:00
vport.c net: openvswitch: unexport ovs_vport_alloc/free 2026-08-13 18:33:35 -07:00
vport.h openvswitch: vport: remove infrastructure for separate modules 2026-08-06 15:09:23 +02:00