From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8B2651C065 for ; Thu, 15 Oct 2026 12:49:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.135.223.130 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792068545; cv=none; b=KTAny1nQI3HG9+7Jmgfg1mMDCCoW/kRsrKCNDTTGpSiXz4aCb19qfcUZiadf6rS5pNNCvV39nZtpm8tcS7oonWggNcXHv1gtD6Uxpb4+9vJ/I0Zbf+lKx7C+BqDbeQIWOY9AjD9w+trbWBKQ2zSNS2xbEP2JTpEchPD8AmQXQl4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792068545; c=relaxed/simple; bh=vv7AXHIi5gcZFMKmnK8J4RAnNVBgy7f431o0PkxBEwk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BKI3qPgMsbgYB38IqKBbG/4N+DiNID01LJykMS1zkGJAcn5WfzpRNrYZyk1U7UrYHmvnrFfkte89/B3/YWjGGnfetwL6b+3btmE7DcKAb0P3d3pRGiNiWCflydsE1kFDSfRSHEBdC4nQ+5yS4XAU46s6DmzG6DSJw08zfpswwvY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=suse.de; spf=pass smtp.mailfrom=suse.de; arc=none smtp.client-ip=195.135.223.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.de Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id C61FD2244E; Thu, 15 Oct 2026 12:49:02 +0000 (UTC) Authentication-Results: smtp-out1.suse.de; none Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id D1B281373D; Thu, 15 Oct 2026 12:48:32 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id 7MJWDY7L0GoCLQAAD6G6ig:T2 (envelope-from ); Thu, 15 Oct 2026 12:48:29 +0000 From: Fernando Fernandez Mancera To: netdev@vger.kernel.org Cc: dev@openvswitch.org, jesse@nicira.com, aatteka@nicira.com, horms@kernel.org, pabeni@redhat.com, kuba@kernel.org, edumazet@kernel.org, davem@davemloft.net, i.maximets@ovn.org, echaudro@redhat.com, aconole@redhat.com, Fernando Fernandez Mancera Subject: [PATCH 2/2 net-next] net: openvswitch: drop IP fragments on SCTP set action Date: Thu, 15 Oct 2026 14:47:49 +0200 Message-ID: <20261015124749.4694-2-fmancera@suse.de> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20261015124749.4694-1-fmancera@suse.de> References: <20261015124749.4694-1-fmancera@suse.de> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Rspamd-Action: no action X-Spam-Flag: NO X-Spam-Score: -4.00 X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spam-Level: X-Rspamd-Queue-Id: C61FD2244E X-Spamd-Result: default: False [-4.00 / 50.00]; REPLY(-4.00)[] X-Rspamd-Server: rspamd2.dmz-prg2.suse.org The SCTP checksum is a CRC32c over the whole SCTP packet. set_sctp() updates it as old_csum ^ old_correct_csum ^ new_csum, with the two CRCs computed over the bytes of the current skb only. That is correct only when the skb holds the whole SCTP packet. For a first fragment, and for a later fragment, it holds just a part of it, and the CRC delta of a change at the start of the packet depends on how many bytes follow, so the checksum written is wrong. The receiver drops the reassembled packet. validate_set() accepts SCTP set action for any flow with ip.proto set to SCTP, regardless of the fragmentation bits, as it only receives the masked key. As the checksum cannot be fixed up without the whole datagram, fail the action for packets that are IP fragments of either family, so the packet is dropped with OVS_DROP_ACTION_ERROR instead of being forwarded with modified ports and an invalid checksum. Link: https://lore.kernel.org/netdev/d4fc14f3-4308-4560-9012-43c09c1b3845@ovn.org/ Fixes: a175a723301a ("openvswitch: Add SCTP support") Signed-off-by: Fernando Fernandez Mancera --- net/openvswitch/actions.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index 4aade471afc4..12e339cbf791 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -674,6 +674,9 @@ static int set_sctp(struct sk_buff *skb, struct sw_flow_key *flow_key, __le32 old_correct_csum, new_csum, old_csum; int err; + if (flow_key->ip.frag != OVS_FRAG_TYPE_NONE) + return -EINVAL; + err = skb_ensure_writable(skb, sctphoff + sizeof(struct sctphdr)); if (unlikely(err)) return err; -- 2.55.0