You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Liping Zhang 3c7af814de openvswitch: fix skb_panic due to the incorrect actions attrlen ... [ Upstream commit 494bea39f3 ] For sw_flow_actions, the actions_len only represents the kernel part's size, and when we dump the actions to the userspace, we will do the convertions, so it's true size may become bigger than the actions_len. But unfortunately, for OVS_PACKET_ATTR_ACTIONS, we use the actions_len to alloc the skbuff, so the user_skb's size may become insufficient and oops will happen like this: skbuff: skb_over_panic: text:ffffffff8148fabf len:1749 put:157 head: ffff881300f39000 data:ffff881300f39000 tail:0x6d5 end:0x6c0 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:129! [...] Call Trace: <IRQ> [<ffffffff8148be82>] skb_put+0x43/0x44 [<ffffffff8148fabf>] skb_zerocopy+0x6c/0x1f4 [<ffffffffa0290d36>] queue_userspace_packet+0x3a3/0x448 [openvswitch] [<ffffffffa0292023>] ovs_dp_upcall+0x30/0x5c [openvswitch] [<ffffffffa028d435>] output_userspace+0x132/0x158 [openvswitch] [<ffffffffa01e6890>] ? ip6_rcv_finish+0x74/0x77 [ipv6] [<ffffffffa028e277>] do_execute_actions+0xcc1/0xdc8 [openvswitch] [<ffffffffa028e3f2>] ovs_execute_actions+0x74/0x106 [openvswitch] [<ffffffffa0292130>] ovs_dp_process_packet+0xe1/0xfd [openvswitch] [<ffffffffa0292b77>] ? key_extract+0x63c/0x8d5 [openvswitch] [<ffffffffa029848b>] ovs_vport_receive+0xa1/0xc3 [openvswitch] [...] Also we can find that the actions_len is much little than the orig_len: crash> struct sw_flow_actions 0xffff8812f539d000 struct sw_flow_actions { rcu = { next = 0xffff8812f5398800, func = 0xffffe3b00035db32 }, orig_len = 1384, actions_len = 592, actions = 0xffff8812f539d01c } So as a quick fix, use the orig_len instead of the actions_len to alloc the user_skb. Last, this oops happened on our system running a relative old kernel, but the same risk still exists on the mainline, since we use the wrong actions_len from the beginning. Fixes: ccea74457b ("openvswitch: include datapath actions with sampled-packet upcall to userspace") Cc: Neil McKee <neil.mckee@inmon.com> Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Acked-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		6 years ago
..
Kconfig	openvswitch: call only into reachable nf-nat code	7 years ago
Makefile	openvswitch: Remove conntrack Kconfig option.	8 years ago
actions.c	openvswitch: fix skb_panic due to the incorrect actions attrlen	6 years ago
conntrack.c	openvswitch: fix potential out of bound access in parse_ct	6 years ago
conntrack.h	openvswitch: Interface with NAT.	7 years ago
datapath.c	openvswitch: fix skb_panic due to the incorrect actions attrlen	6 years ago
datapath.h	openvswitch: fix skb_panic due to the incorrect actions attrlen	6 years ago
dp_notify.c	openvswitch: fix hangup on vxlan/gre/geneve device deletion	7 years ago
flow.c	openvswitch: vlan: remove wrong likely statement	7 years ago
flow.h	openvswitch: use percpu flow stats	7 years ago
flow_netlink.c	openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD	6 years ago
flow_netlink.h	openvswitch: avoid resetting flow key while installing new flow.	7 years ago
flow_table.c	openvswitch: use percpu flow stats	7 years ago
flow_table.h	openvswitch: Zero flows on allocation.	8 years ago
vport-geneve.c	openvswitch: do not ignore netdev errors when creating tunnel vports	7 years ago
vport-gre.c	openvswitch: do not ignore netdev errors when creating tunnel vports	7 years ago
vport-internal_dev.c	openvswitch: add NETIF_F_HW_VLAN_STAG_TX to internal dev	7 years ago
vport-internal_dev.h	openvswitch: introduce rtnl ops stub	9 years ago
vport-netdev.c	net: use skb_postpush_rcsum instead of own implementations	7 years ago
vport-netdev.h	openvswitch: Use dev_queue_xmit for vport send.	8 years ago
vport-vxlan.c	openvswitch: do not ignore netdev errors when creating tunnel vports	7 years ago
vport.c	openvswitch: fix vlan subtraction from packet length	7 years ago
vport.h	net: use skb_postpush_rcsum instead of own implementations	7 years ago