linux/net/openvswitch
Ilya Maximets 1489c195c8 net: openvswitch: fix nested key length validation in the set() action
[ Upstream commit 65d91192aa ]

It's not safe to access nla_len(ovs_key) if the data is smaller than
the netlink header.  Check that the attribute is OK first.

Fixes: ccb1352e76 ("net: Add Open vSwitch kernel components.")
Reported-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b07a9da40df1576b8048
Tested-by: syzbot+b07a9da40df1576b8048@syzkaller.appspotmail.com
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
Acked-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20250412104052.2073688-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-04-25 10:43:50 +02:00
..
actions.c tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). 2025-04-10 14:33:40 +02:00
conntrack.c net: openvswitch: Fix Use-After-Free in ovs_ct_exit 2024-05-02 16:29:25 +02:00
conntrack.h net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct 2021-03-16 15:22:18 -07:00
datapath.c openvswitch: use RCU protection in ovs_vport_cmd_fill_info() 2025-02-21 13:50:08 +01:00
datapath.h net/sched: Enable tc skb ext allocation on chain miss only when needed 2022-02-05 10:12:53 +00:00
dp_notify.c net: openvswitch: use netif_ovs_is_port() instead of opencode 2019-07-08 15:53:25 -07:00
flow.c net: openvswitch: fix overwriting ct original tuple for ICMPv6 2024-06-12 11:03:18 +02:00
flow.h net: openvswitch: IPv6: Add IPv6 extension header support 2022-02-25 10:32:55 +00:00
flow_netlink.c net: openvswitch: fix nested key length validation in the set() action 2025-04-25 10:43:50 +02:00
flow_netlink.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 269 2019-06-05 17:30:29 +02:00
flow_table.c openvswitch: Optimize operation for key comparison 2021-07-01 11:13:10 -07:00
flow_table.h net: openvswitch: fix to make sure flow_lookup() is not preempted 2020-10-18 12:29:36 -07:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile openvswitch: add trace points 2021-06-22 10:47:32 -07:00
meter.c net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() 2023-02-22 12:59:52 +01:00
meter.h net: openvswitch: use u64 for meter bucket 2020-04-23 18:26:11 -07:00
openvswitch_trace.c openvswitch: add trace points 2021-06-22 10:47:32 -07:00
openvswitch_trace.h openvswitch: add trace points 2021-06-22 10:47:32 -07:00
vport-geneve.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
vport-gre.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 269 2019-06-05 17:30:29 +02:00
vport-internal_dev.c openvswitch: Change the return type for vport_ops.send function hook to int 2022-09-19 18:28:50 -07:00
vport-internal_dev.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 269 2019-06-05 17:30:29 +02:00
vport-netdev.c net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
vport-netdev.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 269 2019-06-05 17:30:29 +02:00
vport-vxlan.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 269 2019-06-05 17:30:29 +02:00
vport.c net: Add skb_clear_tstamp() to keep the mono delivery_time 2022-03-03 14:38:48 +00:00
vport.h openvswitch: Change the return type for vport_ops.send function hook to int 2022-09-19 18:28:50 -07:00