mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-14 06:22:34 +02:00
Ilya Maximets
83861c48ba
When a tunnel vport is created it first creates the tunnel device, e.g.,
with geneve_dev_create_fb(), then it calls ovs_netdev_link() to take a
reference and link it to the device that represents openvswitch datapath.
The creation of the device is happening under RTNL, but then RTNL is
released and re-acquired to find the device by name. It is technically
possible for the tunnel device to be re-named or deleted within that
window while RTNL is not held, and some other device created in its
place. This will cause a non-tunnel device to be referenced in the
vport and tunnel-specific functions used on it, e.g. vxlan_get_options()
that directly casts the private netdev data into a struct vxlan_dev
causing an invalid memory access:
BUG: KASAN: slab-use-after-free in vxlan_get_options+0x323/0x3a0
vxlan_get_options+0x323/0x3a0
ovs_vport_cmd_new+0x6e3/0xd30
Fix that by taking a reference to the just created device before
releasing RTNL. This ensures that the device in the vport is always
the one that was just created. The search by name is only needed
for a standard vport-netdev that links pre-existing devices, so that
functionality and device type checks are moved to netdev_create().
It is also awkward that ovs_netdev_link() takes ownership of the vport
and destroys it on failure. It doesn't know the type of the port it is
dealing with, so we need to pass down the indicator that it's a tunnel,
so the link can be properly deleted on failure.
It's possible to refactor the logic to make the ovs_netdev_link() do
only the linking part and let the callers perform a proper destruction,
but it will be much more code for each legacy tunnel port type, so it
is not worth it for the bug fix.
Fixes: 614732eaa1 ("openvswitch: Use regular VXLAN net_device device")
Reported-by: Yuan Tan <tanyuan98@outlook.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Reported-by: Yang Yang <n05ec@lzu.edu.cn>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Link: https://patch.msgid.link/20260430213349.407991-1-i.maximets@ovn.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
144 lines
3.0 KiB
C
144 lines
3.0 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Copyright (c) 2014 Nicira, Inc.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/in.h>
|
|
#include <linux/ip.h>
|
|
#include <linux/net.h>
|
|
#include <linux/rculist.h>
|
|
#include <linux/udp.h>
|
|
#include <linux/if_vlan.h>
|
|
#include <linux/module.h>
|
|
|
|
#include <net/geneve.h>
|
|
#include <net/icmp.h>
|
|
#include <net/ip.h>
|
|
#include <net/route.h>
|
|
#include <net/udp.h>
|
|
#include <net/xfrm.h>
|
|
|
|
#include "datapath.h"
|
|
#include "vport.h"
|
|
#include "vport-netdev.h"
|
|
|
|
static struct vport_ops ovs_geneve_vport_ops;
|
|
/**
|
|
* struct geneve_port - Keeps track of open UDP ports
|
|
* @dst_port: destination port.
|
|
*/
|
|
struct geneve_port {
|
|
u16 dst_port;
|
|
};
|
|
|
|
static inline struct geneve_port *geneve_vport(const struct vport *vport)
|
|
{
|
|
return vport_priv(vport);
|
|
}
|
|
|
|
static int geneve_get_options(const struct vport *vport,
|
|
struct sk_buff *skb)
|
|
{
|
|
struct geneve_port *geneve_port = geneve_vport(vport);
|
|
|
|
if (nla_put_u16(skb, OVS_TUNNEL_ATTR_DST_PORT, geneve_port->dst_port))
|
|
return -EMSGSIZE;
|
|
return 0;
|
|
}
|
|
|
|
static struct vport *geneve_tnl_create(const struct vport_parms *parms)
|
|
{
|
|
struct net *net = ovs_dp_get_net(parms->dp);
|
|
struct nlattr *options = parms->options;
|
|
struct geneve_port *geneve_port;
|
|
struct net_device *dev;
|
|
struct vport *vport;
|
|
struct nlattr *a;
|
|
u16 dst_port;
|
|
int err;
|
|
|
|
if (!options) {
|
|
err = -EINVAL;
|
|
goto error;
|
|
}
|
|
|
|
a = nla_find_nested(options, OVS_TUNNEL_ATTR_DST_PORT);
|
|
if (a && nla_len(a) == sizeof(u16)) {
|
|
dst_port = nla_get_u16(a);
|
|
} else {
|
|
/* Require destination port from userspace. */
|
|
err = -EINVAL;
|
|
goto error;
|
|
}
|
|
|
|
vport = ovs_vport_alloc(sizeof(struct geneve_port),
|
|
&ovs_geneve_vport_ops, parms);
|
|
if (IS_ERR(vport))
|
|
return vport;
|
|
|
|
geneve_port = geneve_vport(vport);
|
|
geneve_port->dst_port = dst_port;
|
|
|
|
rtnl_lock();
|
|
dev = geneve_dev_create_fb(net, parms->name, NET_NAME_USER, dst_port);
|
|
if (IS_ERR(dev)) {
|
|
rtnl_unlock();
|
|
ovs_vport_free(vport);
|
|
return ERR_CAST(dev);
|
|
}
|
|
|
|
err = dev_change_flags(dev, dev->flags | IFF_UP, NULL);
|
|
if (err < 0) {
|
|
rtnl_delete_link(dev, 0, NULL);
|
|
rtnl_unlock();
|
|
ovs_vport_free(vport);
|
|
goto error;
|
|
}
|
|
|
|
vport->dev = dev;
|
|
netdev_hold(vport->dev, &vport->dev_tracker, GFP_KERNEL);
|
|
|
|
rtnl_unlock();
|
|
return vport;
|
|
error:
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
static struct vport *geneve_create(const struct vport_parms *parms)
|
|
{
|
|
struct vport *vport;
|
|
|
|
vport = geneve_tnl_create(parms);
|
|
if (IS_ERR(vport))
|
|
return vport;
|
|
|
|
return ovs_netdev_link(vport, true);
|
|
}
|
|
|
|
static struct vport_ops ovs_geneve_vport_ops = {
|
|
.type = OVS_VPORT_TYPE_GENEVE,
|
|
.create = geneve_create,
|
|
.destroy = ovs_netdev_tunnel_destroy,
|
|
.get_options = geneve_get_options,
|
|
.send = dev_queue_xmit,
|
|
};
|
|
|
|
static int __init ovs_geneve_tnl_init(void)
|
|
{
|
|
return ovs_vport_ops_register(&ovs_geneve_vport_ops);
|
|
}
|
|
|
|
static void __exit ovs_geneve_tnl_exit(void)
|
|
{
|
|
ovs_vport_ops_unregister(&ovs_geneve_vport_ops);
|
|
}
|
|
|
|
module_init(ovs_geneve_tnl_init);
|
|
module_exit(ovs_geneve_tnl_exit);
|
|
|
|
MODULE_DESCRIPTION("OVS: Geneve switching port");
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS("vport-type-5");
|