Andrea Righi
12ff23da75
openvswitch: fix flow actions reallocation
[ Upstream commit f28cd2af22a0c134e4aa1c64a70f70d815d473fb ]
The flow action buffer can be resized if it's not big enough to contain
all the requested flow actions. However, this resize doesn't take into
account the new requested size, the buffer is only increased by a factor
of 2x. This might be not enough to contain the new data, causing a
buffer overflow, for example:
[ 42.044472] =============================================================================
[ 42.045608] BUG kmalloc-96 (Not tainted): Redzone overwritten
[ 42.046415] -----------------------------------------------------------------------------
[ 42.047715] Disabling lock debugging due to kernel taint
[ 42.047716] INFO: 0x8bf2c4a5-0x720c0928. First byte 0x0 instead of 0xcc
[ 42.048677] INFO: Slab 0xbc6d2040 objects=29 used=18 fp=0xdc07dec4 flags=0x2808101
[ 42.049743] INFO: Object 0xd53a3464 @offset=2528 fp=0xccdcdebb
[ 42.050747] Redzone 76f1b237: cc cc cc cc cc cc cc cc ........
[ 42.051839] Object d53a3464: 6b 6b 6b 6b 6b 6b 6b 6b 0c 00 00 00 6c 00 00 00 kkkkkkkk....l...
[ 42.053015] Object f49a30cc: 6c 00 0c 00 00 00 00 00 00 00 00 03 78 a3 15 f6 l...........x...
[ 42.054203] Object acfe4220: 20 00 02 00 ff ff ff ff 00 00 00 00 00 00 00 00 ...............
[ 42.055370] Object 21024e91: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 42.056541] Object 070e04c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 42.057797] Object 948a777a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 42.059061] Redzone 8bf2c4a5: 00 00 00 00 ....
[ 42.060189] Padding a681b46e: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
Fix by making sure the new buffer is properly resized to contain all the
requested data.
BugLink: https://bugs.launchpad.net/bugs/1813244
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-04-17 08:36:44 +02:00 |
| .. |
|
actions.c
|
openvswitch: fix skb_panic due to the incorrect actions attrlen
|
2017-08-30 10:21:40 +02:00 |
|
conntrack.c
|
openvswitch: Remove padding from packet before L3+ conntrack processing
|
2018-05-30 07:50:23 +02:00 |
|
conntrack.h
|
openvswitch: Interface with NAT.
|
2016-03-14 23:47:29 +01:00 |
|
datapath.c
|
openvswitch: fix skb_panic due to the incorrect actions attrlen
|
2017-08-30 10:21:40 +02:00 |
|
datapath.h
|
openvswitch: fix skb_panic due to the incorrect actions attrlen
|
2017-08-30 10:21:40 +02:00 |
|
dp_notify.c
|
openvswitch: fix hangup on vxlan/gre/geneve device deletion
|
2015-12-03 14:29:25 -05:00 |
|
flow.c
|
openvswitch: vlan: remove wrong likely statement
|
2016-10-13 10:03:23 -04:00 |
|
flow.h
|
openvswitch: use percpu flow stats
|
2016-09-18 22:14:01 -04:00 |
|
flow_netlink.c
|
openvswitch: fix flow actions reallocation
|
2019-04-17 08:36:44 +02:00 |
|
flow_netlink.h
|
openvswitch: avoid resetting flow key while installing new flow.
|
2016-09-20 22:54:35 -04:00 |
|
flow_table.c
|
openvswitch: use percpu flow stats
|
2016-09-18 22:14:01 -04:00 |
|
flow_table.h
|
openvswitch: Zero flows on allocation.
|
2015-09-22 17:33:41 -07:00 |
|
Kconfig
|
openvswitch: call only into reachable nf-nat code
|
2016-03-28 17:58:59 +02:00 |
|
Makefile
|
openvswitch: Remove conntrack Kconfig option.
|
2015-09-06 23:48:33 -07:00 |
|
vport-geneve.c
|
openvswitch: do not ignore netdev errors when creating tunnel vports
|
2016-08-10 23:13:23 -07:00 |
|
vport-gre.c
|
openvswitch: do not ignore netdev errors when creating tunnel vports
|
2016-08-10 23:13:23 -07:00 |
|
vport-internal_dev.c
|
openvswitch: add NETIF_F_HW_VLAN_STAG_TX to internal dev
|
2016-10-13 10:03:23 -04:00 |
|
vport-internal_dev.h
|
openvswitch: introduce rtnl ops stub
|
2014-07-01 14:40:17 -07:00 |
|
vport-netdev.c
|
net: use skb_postpush_rcsum instead of own implementations
|
2016-02-19 23:43:10 -05:00 |
|
vport-netdev.h
|
openvswitch: Use dev_queue_xmit for vport send.
|
2015-10-22 06:46:16 -07:00 |
|
vport-vxlan.c
|
openvswitch: do not ignore netdev errors when creating tunnel vports
|
2016-08-10 23:13:23 -07:00 |
|
vport.c
|
openvswitch: fix vlan subtraction from packet length
|
2016-10-13 10:03:23 -04:00 |
|
vport.h
|
net: use skb_postpush_rcsum instead of own implementations
|
2016-02-19 23:43:10 -05:00 |