Patch "net: openvswitch: fix overwriting ct original tuple for ICMPv6" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: openvswitch: fix overwriting ct original tuple for ICMPv6

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-openvswitch-fix-overwriting-ct-original-tuple-fo.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 690330318e3454a055cb7bca8c0e511ce7427c70
Author: Ilya Maximets <i.maximets@xxxxxxx>
Date:   Thu May 9 11:38:05 2024 +0200

    net: openvswitch: fix overwriting ct original tuple for ICMPv6
    
    [ Upstream commit 7c988176b6c16c516474f6fceebe0f055af5eb56 ]
    
    OVS_PACKET_CMD_EXECUTE has 3 main attributes:
     - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format.
     - OVS_PACKET_ATTR_PACKET - Binary packet content.
     - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet.
    
    OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure
    with the metadata like conntrack state, input port, recirculation id,
    etc.  Then the packet itself gets parsed to populate the rest of the
    keys from the packet headers.
    
    Whenever the packet parsing code starts parsing the ICMPv6 header, it
    first zeroes out fields in the key corresponding to Neighbor Discovery
    information even if it is not an ND packet.
    
    It is an 'ipv6.nd' field.  However, the 'ipv6' is a union that shares
    the space between 'nd' and 'ct_orig' that holds the original tuple
    conntrack metadata parsed from the OVS_PACKET_ATTR_KEY.
    
    ND packets should not normally have conntrack state, so it's fine to
    share the space, but normal ICMPv6 Echo packets or maybe other types of
    ICMPv6 can have the state attached and it should not be overwritten.
    
    The issue results in all but the last 4 bytes of the destination
    address being wiped from the original conntrack tuple leading to
    incorrect packet matching and potentially executing wrong actions
    in case this packet recirculates within the datapath or goes back
    to userspace.
    
    ND fields should not be accessed in non-ND packets, so not clearing
    them should be fine.  Executing memset() only for actual ND packets to
    avoid the issue.
    
    Initializing the whole thing before parsing is needed because ND packet
    may not contain all the options.
    
    The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't
    affect packets entering OVS datapath from network interfaces, because
    in this case CT metadata is populated from skb after the packet is
    already parsed.
    
    Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack tuple to sw_flow_key.")
    Reported-by: Antonin Bas <antonin.bas@xxxxxxxxxxxx>
    Closes: https://github.com/openvswitch/ovs-issues/issues/327
    Signed-off-by: Ilya Maximets <i.maximets@xxxxxxx>
    Acked-by: Aaron Conole <aconole@xxxxxxxxxx>
    Acked-by: Eelco Chaudron <echaudro@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240509094228.1035477-1-i.maximets@xxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 1b81d71bac3cf..209b42cf5aeaf 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -417,7 +417,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
 	 */
 	key->tp.src = htons(icmp->icmp6_type);
 	key->tp.dst = htons(icmp->icmp6_code);
-	memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
 
 	if (icmp->icmp6_code == 0 &&
 	    (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
@@ -426,6 +425,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
 		struct nd_msg *nd;
 		int offset;
 
+		memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
+
 		/* In order to process neighbor discovery options, we need the
 		 * entire packet.
 		 */




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux