[PATCH net] openvswitch: Fix unsafe attribute parsing in output_userspace()

[PATCH net] openvswitch: Fix unsafe attribute parsing in output_userspace()

[Eelco Chaudron]

This patch replaces the manual Netlink attribute iteration in
output_userspace() with nla_for_each_nested(), which ensures that only
well-formed attributes are processed.

Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
---
 net/openvswitch/actions.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 61fea7baae5d..2f22ca59586f 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -975,8 +975,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb,
 	upcall.cmd = OVS_PACKET_CMD_ACTION;
 	upcall.mru = OVS_CB(skb)->mru;
 
-	for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
-	     a = nla_next(a, &rem)) {
+	nla_for_each_nested(a, attr, rem) {
 		switch (nla_type(a)) {
 		case OVS_USERSPACE_ATTR_USERDATA:
 			upcall.userdata = a;
-- 
2.47.1

Re: [PATCH net] openvswitch: Fix unsafe attribute parsing in output_userspace()

[Ilya Maximets]

On 5/6/25 4:28 PM, Eelco Chaudron wrote:
> This patch replaces the manual Netlink attribute iteration in
> output_userspace() with nla_for_each_nested(), which ensures that only
> well-formed attributes are processed.
> 
> Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
> Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
> ---
>  net/openvswitch/actions.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)

Should probably add a Reported-by tag referencing the report id
and mention the reporter in the commit message.

Otherwise, LGTM.  Thanks!

Acked-by: Ilya Maximets <i.maximets@ovn.org>

> 
> diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
> index 61fea7baae5d..2f22ca59586f 100644
> --- a/net/openvswitch/actions.c
> +++ b/net/openvswitch/actions.c
> @@ -975,8 +975,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb,
>  	upcall.cmd = OVS_PACKET_CMD_ACTION;
>  	upcall.mru = OVS_CB(skb)->mru;
>  
> -	for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
> -	     a = nla_next(a, &rem)) {
> +	nla_for_each_nested(a, attr, rem) {
>  		switch (nla_type(a)) {
>  		case OVS_USERSPACE_ATTR_USERDATA:
>  			upcall.userdata = a;

Re: [PATCH net] openvswitch: Fix unsafe attribute parsing in output_userspace()

[Aaron Conole]

Eelco Chaudron <echaudro@redhat.com> writes:

> This patch replaces the manual Netlink attribute iteration in
> output_userspace() with nla_for_each_nested(), which ensures that only
> well-formed attributes are processed.
>
> Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
> Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
> ---

Acked-by: Aaron Conole <aconole@redhat.com>

Re: [PATCH net] openvswitch: Fix unsafe attribute parsing in output_userspace()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue,  6 May 2025 16:28:54 +0200 you wrote:
> This patch replaces the manual Netlink attribute iteration in
> output_userspace() with nla_for_each_nested(), which ensures that only
> well-formed attributes are processed.
> 
> Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
> Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
> 
> [...]

Here is the summary with links:
  - [net] openvswitch: Fix unsafe attribute parsing in output_userspace()
    https://git.kernel.org/netdev/net/c/6beb6835c1fb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html