6.1-stable patches

added patches:
	openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch

diff --git a/queue-6.1/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch b/queue-6.1/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch
new file mode 100644 (file)
index 0000000..1a42384
--- /dev/null
+++ b/queue-6.1/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch
@@ -0,0 +1,36 @@
+From 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 Mon Sep 17 00:00:00 2001
+From: Eelco Chaudron <echaudro@redhat.com>
+Date: Tue, 6 May 2025 16:28:54 +0200
+Subject: openvswitch: Fix unsafe attribute parsing in output_userspace()
+
+From: Eelco Chaudron <echaudro@redhat.com>
+
+commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream.
+
+This patch replaces the manual Netlink attribute iteration in
+output_userspace() with nla_for_each_nested(), which ensures that only
+well-formed attributes are processed.
+
+Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
+Signed-off-by: Eelco Chaudron <echaudro@redhat.com>
+Acked-by: Ilya Maximets <i.maximets@ovn.org>
+Acked-by: Aaron Conole <aconole@redhat.com>
+Link: https://patch.msgid.link/0bd65949df61591d9171c0dc13e42cea8941da10.1746541734.git.echaudro@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/openvswitch/actions.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -954,8 +954,7 @@ static int output_userspace(struct datap
+       upcall.cmd = OVS_PACKET_CMD_ACTION;
+       upcall.mru = OVS_CB(skb)->mru;
+ 
+-      for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
+-           a = nla_next(a, &rem)) {
++      nla_for_each_nested(a, attr, rem) {
+               switch (nla_type(a)) {
+               case OVS_USERSPACE_ATTR_USERDATA:
+                       upcall.userdata = a;

diff --git a/queue-6.1/series b/queue-6.1/series
index b0a1472c14efa47c6168d0b175cb3cf5e283a7e1..ee9a6eca915ad1dfbd1b3db3a7c0413a01fc0cd6 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -3,3 +3,4 @@ arm64-dts-imx8mm-verdin-link-reg_usdhc2_vqmmc-to-usdhc2.patch
 can-mcan-m_can_class_unregister-fix-order-of-unregistration-calls.patch
 can-mcp251xfd-mcp251xfd_remove-fix-order-of-unregistration-calls.patch
 ksmbd-prevent-out-of-bounds-stream-writes-by-validating-pos.patch
+openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch