netdev - Re: [PATCH net v2 1/2] net: openvswitch: limit the number of recursions from action sets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240208112945.GG1435458@kernel.org>
Date: Thu, 8 Feb 2024 11:29:45 +0000
From: Simon Horman <horms@...nel.org>
To: Aaron Conole <aconole@...hat.com>
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Pravin B Shelar <pshelar@....org>, dev@...nvswitch.org,
	Ilya Maximets <i.maximets@....org>,
	Eelco Chaudron <echaudro@...hat.com>, Shuah Khan <shuah@...nel.org>,
	linux-kselftest@...r.kernel.org, Andy Zhou <azhou@....org>
Subject: Re: [PATCH net v2 1/2] net: openvswitch: limit the number of
 recursions from action sets

On Wed, Feb 07, 2024 at 08:24:15AM -0500, Aaron Conole wrote:
> The ovs module allows for some actions to recursively contain an action
> list for complex scenarios, such as sampling, checking lengths, etc.
> When these actions are copied into the internal flow table, they are
> evaluated to validate that such actions make sense, and these calls
> happen recursively.
> 
> The ovs-vswitchd userspace won't emit more than 16 recursion levels
> deep.  However, the module has no such limit and will happily accept
> limits larger than 16 levels nested.  Prevent this by tracking the
> number of recursions happening and manually limiting it to 16 levels
> nested.
> 
> The initial implementation of the sample action would track this depth
> and prevent more than 3 levels of recursion, but this was removed to
> support the clone use case, rather than limited at the current userspace
> limit.
> 
> Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases")
> Signed-off-by: Aaron Conole <aconole@...hat.com>
> ---
> v1->v2: Switch to tracking the stack depth by using a depth argument rather than
>         a per-cpu counter.

Thanks for the update.

Reviewed-by: Simon Horman <horms@...nel.org>