[PATCH net] net: nsh: fix incorrect header length macros

[PATCH net] net: nsh: fix incorrect header length macros

[Ilya Maximets]

NSH header length is a 6-bit field that encodes the total length of
the header in 4-byte words.  So the maximum length is 0b111111 * 4,
which is 252 and not 256.  The maximum context length is the same
number minus the length of the base header (8), so 244.

These macros are used to validate push_nsh() action in openvswitch.
Miscalculation here doesn't cause any real issues.  In the worst case
the oversized context is truncated while building the header, so we'll
construct and send a broken packet, which is not a big problem, as any
receiver should validate the fields.  No invalid memory accesses will
happen during the header push.  But we should fix the macros to reject
the incorrect actions in the first place.

Using previously defined values and calculating the length instead
of defining numbers directly, so it's easier to understand where they
come from and harder to make a mistake.

Fixes: 1f0b7744c505 ("net: add NSH header structures and helpers")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
---

These macros were fixed in the userspace variant of this header some
years ago (by just adjusting the numbers though):
  https://patchwork.ozlabs.org/project/openvswitch/patch/1540503710-23597-1-git-send-email-pkusunyifeng@gmail.com/
And there was a patch a few weeks ago with the attempt to change the
validation for push_nsh() instead of fixing the macros:
  https://lore.kernel.org/all/9d2b5c6127e149ebd35094d662bfd008c20347c2.1777120226.git.ldy3087146292@gmail.com/
I haven't heard back from the author, so sending this patch myself
to cross it out of my todo list.  It's not a v2, as it's more of a
separate change, even though the outcome is similar.

 include/net/nsh.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/nsh.h b/include/net/nsh.h
index 16a7510938969..15a26c5908151 100644
--- a/include/net/nsh.h
+++ b/include/net/nsh.h
@@ -247,10 +247,10 @@ struct nshhdr {
 #define NSH_M_TYPE1_LEN   24
 
 /* NSH header maximum Length. */
-#define NSH_HDR_MAX_LEN 256
+#define NSH_HDR_MAX_LEN ((NSH_LEN_MASK >> NSH_LEN_SHIFT) * 4)
 
 /* NSH context headers maximum Length. */
-#define NSH_CTX_HDRS_MAX_LEN 248
+#define NSH_CTX_HDRS_MAX_LEN (NSH_HDR_MAX_LEN - NSH_BASE_HDR_LEN)
 
 static inline struct nshhdr *nsh_hdr(struct sk_buff *skb)
 {
-- 
2.53.0

Re: [PATCH net] net: nsh: fix incorrect header length macros

[Aaron Conole]

Ilya Maximets <i.maximets@ovn.org> writes:

> NSH header length is a 6-bit field that encodes the total length of
> the header in 4-byte words.  So the maximum length is 0b111111 * 4,
> which is 252 and not 256.  The maximum context length is the same
> number minus the length of the base header (8), so 244.
>
> These macros are used to validate push_nsh() action in openvswitch.
> Miscalculation here doesn't cause any real issues.  In the worst case
> the oversized context is truncated while building the header, so we'll
> construct and send a broken packet, which is not a big problem, as any
> receiver should validate the fields.  No invalid memory accesses will
> happen during the header push.  But we should fix the macros to reject
> the incorrect actions in the first place.
>
> Using previously defined values and calculating the length instead
> of defining numbers directly, so it's easier to understand where they
> come from and harder to make a mistake.
>
> Fixes: 1f0b7744c505 ("net: add NSH header structures and helpers")
> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
> ---

Thanks Ilya!

Reviewed-by: Aaron Conole <aconole@redhat.com>

Re: [PATCH net] net: nsh: fix incorrect header length macros

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu,  7 May 2026 14:04:26 +0200 you wrote:
> NSH header length is a 6-bit field that encodes the total length of
> the header in 4-byte words.  So the maximum length is 0b111111 * 4,
> which is 252 and not 256.  The maximum context length is the same
> number minus the length of the base header (8), so 244.
> 
> These macros are used to validate push_nsh() action in openvswitch.
> Miscalculation here doesn't cause any real issues.  In the worst case
> the oversized context is truncated while building the header, so we'll
> construct and send a broken packet, which is not a big problem, as any
> receiver should validate the fields.  No invalid memory accesses will
> happen during the header push.  But we should fix the macros to reject
> the incorrect actions in the first place.
> 
> [...]

Here is the summary with links:
  - [net] net: nsh: fix incorrect header length macros
    https://git.kernel.org/netdev/net/c/f2ab4fd02777

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html