Commit cbb9c721 authored by Eric Dumazet's avatar Eric Dumazet Committed by Wentao Guan
Browse files

openvswitch: use RCU protection in ovs_vport_cmd_fill_info() 

stable inclusion
from stable-v6.6.79
commit 8ec57509c36c8b9a23e50b7858dda0c520a2d074
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBXANC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8ec57509c36c8b9a23e50b7858dda0c520a2d074



--------------------------------

[ Upstream commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d ]

ovs_vport_cmd_fill_info() can be called without RTNL or RCU.

Use RCU protection and dev_net_rcu() to avoid potential UAF.

Fixes: 9354d452 ("openvswitch: reliable interface indentification in port dumps")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
(cherry picked from commit 8ec57509c36c8b9a23e50b7858dda0c520a2d074)
Signed-off-by: default avatarWentao Guan <guanwentao@uniontech.com>
parent fd9edcbc

net/openvswitch/datapath.c

+9 −3
Original line number Diff line number Diff line
@@ -2103,6 +2103,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, 
{

	struct ovs_header *ovs_header;

	struct ovs_vport_stats vport_stats;

	struct net *net_vport;

	int err;



	ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family,
@@ -2119,12 +2120,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, 
	    nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex))

		goto nla_put_failure;



	if (!net_eq(net, dev_net(vport->dev))) {

		int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);

	rcu_read_lock();

	net_vport = dev_net_rcu(vport->dev);

	if (!net_eq(net, net_vport)) {

		int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC);



		if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))

			goto nla_put_failure;

			goto nla_put_failure_unlock;

	}

	rcu_read_unlock();



	ovs_vport_get_stats(vport, &vport_stats);

	if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS,
@@ -2145,6 +2149,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, 
	genlmsg_end(skb, ovs_header);

	return 0;



nla_put_failure_unlock:

	rcu_read_unlock();

nla_put_failure:

	err = -EMSGSIZE;

error: