Asim Viladi Oglu Manizada <[email protected]> writes: > Open vSwitch stores generated flow actions as nlattrs, whose nla_len > field is u16. Commit a1e64addf3ff ("net: openvswitch: remove > misbehaving actions length check") allowed the total sw_flow_actions > stream to grow beyond 64 KiB, which is valid, but also removed the last > guard preventing a generated nested action attribute from exceeding > U16_MAX. > > An oversized generated container can thus be closed with a truncated > nla_len. A later dump or teardown then walks a structurally different > stream than the one that was validated. In particular, an oversized > nested CLONE/CT action may cause subsequent bytes in the generated > stream to be interpreted as independent actions. > > Keep the larger total-action-stream behavior, but make nested action > close reject generated containers that do not fit in nla_len, and return > the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and > CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse > construction order before discarding failed wrappers, so resources copied > into the rejected tails are released before the wrappers are removed. > > Most failed outer wrappers are discarded by truncating actions_len after > child resources have been released. CHECK_PKT_LEN also trims its parent > after branch resources are gone. SET/TUNNEL close failures unwind their > known tun_dst ownership directly, and SET_TO_MASKED has no external > ownership and truncates on close failure. > > Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions > length check") > Cc: [email protected] > Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix > Signed-off-by: Asim Viladi Oglu Manizada <[email protected]> > ---
Thanks for the fix! Reviewed-by: Aaron Conole <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
