linux-kernel - Re: [PATCH net] net: openvswitch: fix middle attribute validation in push

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: 
 <176535660704.514912.11425837372382255386.git-patchwork-notify@kernel.org>
Date: Wed, 10 Dec 2025 08:50:07 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Ilya Maximets <i.maximets@....org>
Cc: netdev@...r.kernel.org, davem@...emloft.net, edumazet@...gle.com,
 kuba@...nel.org, pabeni@...hat.com, horms@...nel.org,
 linux-kernel@...r.kernel.org, dev@...nvswitch.org, echaudro@...hat.com,
 aconole@...hat.com, w@....eu, kwqcheii@...ton.me, zhuque@...cent.com
Subject: Re: [PATCH net] net: openvswitch: fix middle attribute validation in
 push_nsh() action

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@...nel.org>:

On Thu,  4 Dec 2025 11:53:32 +0100 you wrote:
> The push_nsh() action structure looks like this:
> 
>  OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...))
> 
> The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the
> nla_for_each_nested() inside __ovs_nla_copy_actions().  The innermost
> OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested()
> inside nsh_key_put_from_nlattr().  But nothing checks if the attribute
> in the middle is OK.  We don't even check that this attribute is the
> OVS_KEY_ATTR_NSH.  We just do a double unwrap with a pair of nla_data()
> calls - first time directly while calling validate_push_nsh() and the
> second time as part of the nla_for_each_nested() macro, which isn't
> safe, potentially causing invalid memory access if the size of this
> attribute is incorrect.  The failure may not be noticed during
> validation due to larger netlink buffer, but cause trouble later during
> action execution where the buffer is allocated exactly to the size:
> 
> [...]

Here is the summary with links:
  - [net] net: openvswitch: fix middle attribute validation in push_nsh() action
    https://git.kernel.org/netdev/net/c/5ace7ef87f05

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html