diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-09 10:58:22 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-09 10:58:22 +0200 |
| commit | 0e4f80bb320c4bf90ca56dfef8139d96a1313e53 (patch) | |
| tree | dc17244d2a916dd7224ed4a9e2108d44d1ac0f8b | |
| parent | c294a4e88724b4e32847f4608f72936909ad2438 (diff) | |
| download | stable-queue-0e4f80bb320c4bf90ca56dfef8139d96a1313e53.tar.gz | |
6.6-stable patches
added patches:
openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch
| -rw-r--r-- | queue-6.6/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch | 36 | ||||
| -rw-r--r-- | queue-6.6/series | 1 |
2 files changed, 37 insertions, 0 deletions
diff --git a/queue-6.6/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch b/queue-6.6/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch new file mode 100644 index 00000000000..1167fd7e04f --- /dev/null +++ b/queue-6.6/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch @@ -0,0 +1,36 @@ +From 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 Mon Sep 17 00:00:00 2001 +From: Eelco Chaudron <echaudro@redhat.com> +Date: Tue, 6 May 2025 16:28:54 +0200 +Subject: openvswitch: Fix unsafe attribute parsing in output_userspace() + +From: Eelco Chaudron <echaudro@redhat.com> + +commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream. + +This patch replaces the manual Netlink attribute iteration in +output_userspace() with nla_for_each_nested(), which ensures that only +well-formed attributes are processed. + +Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") +Signed-off-by: Eelco Chaudron <echaudro@redhat.com> +Acked-by: Ilya Maximets <i.maximets@ovn.org> +Acked-by: Aaron Conole <aconole@redhat.com> +Link: https://patch.msgid.link/0bd65949df61591d9171c0dc13e42cea8941da10.1746541734.git.echaudro@redhat.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + net/openvswitch/actions.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -959,8 +959,7 @@ static int output_userspace(struct datap + upcall.cmd = OVS_PACKET_CMD_ACTION; + upcall.mru = OVS_CB(skb)->mru; + +- for (a = nla_data(attr), rem = nla_len(attr); rem > 0; +- a = nla_next(a, &rem)) { ++ nla_for_each_nested(a, attr, rem) { + switch (nla_type(a)) { + case OVS_USERSPACE_ATTR_USERDATA: + upcall.userdata = a; diff --git a/queue-6.6/series b/queue-6.6/series index 843cabcccaa..bf7e7693598 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -6,3 +6,4 @@ can-mcp251xfd-mcp251xfd_remove-fix-order-of-unregistration-calls.patch ksmbd-prevent-rename-with-empty-string.patch ksmbd-prevent-out-of-bounds-stream-writes-by-validating-pos.patch ksmbd-fix-uaf-in-__close_file_table_ids.patch +openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch |