openvswitch: Zero flows on allocation.

commit ae5f2fb1d51fa128a460bcfbe3c56d7ab8bf6a43 upstream.

When support for megaflows was introduced, OVS needed to start
installing flows with a mask applied to them. Since masking is an
expensive operation, OVS also had an optimization that would only
take the parts of the flow keys that were covered by a non-zero
mask. The values stored in the remaining pieces should not matter
because they are masked out.

While this works fine for the purposes of matching (which must always
look at the mask), serialization to netlink can be problematic. Since
the flow and the mask are serialized separately, the uninitialized
portions of the flow can be encoded with whatever values happen to be
present.

In terms of functionality, this has little effect since these fields
will be masked out by definition. However, it leaks kernel memory to
userspace, which is a potential security vulnerability. It is also
possible that other code paths could look at the masked key and get
uninitialized data, although this does not currently appear to be an
issue in practice.

This removes the mask optimization for flows that are being installed.
This was always intended to be the case as the mask optimizations were
really targetting per-packet flow operations.

Fixes: 03f0d916 ("openvswitch: Mega flow implementation")
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 4e6176d9a6cde7d229dbaf1aae53027b4a888740..15a8a568018c9c9698070a2b299dcd50d12b38a0 100644 (file)
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -827,7 +827,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
        if (error)
                goto err_kfree_flow;
 
-       ovs_flow_mask_key(&new_flow->key, &new_flow->unmasked_key, &mask);
+       ovs_flow_mask_key(&new_flow->key, &new_flow->unmasked_key, true, &mask);
 
        /* Validate actions. */
        acts = ovs_nla_alloc_flow_actions(nla_len(a[OVS_FLOW_ATTR_ACTIONS]));
@@ -961,7 +961,7 @@ static int ovs_flow_cmd_set(struct sk_buff *skb, struct genl_info *info)
                if (IS_ERR(acts))
                        goto error;
 
-               ovs_flow_mask_key(&masked_key, &key, &mask);
+               ovs_flow_mask_key(&masked_key, &key, true, &mask);
                error = ovs_nla_copy_actions(a[OVS_FLOW_ATTR_ACTIONS],
                                             &masked_key, 0, &acts);
                if (error) {

diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index cf2d853646f05dc61a1c8f9093782196860ab9bc..740041a09b9d79b88b859841b8808488f9954454 100644 (file)
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -56,20 +56,21 @@ static u16 range_n_bytes(const struct sw_flow_key_range *range)
 }
 
 void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
-                      const struct sw_flow_mask *mask)
+                      bool full, const struct sw_flow_mask *mask)
 {
-       const long *m = (const long *)((const u8 *)&mask->key +
-                               mask->range.start);
-       const long *s = (const long *)((const u8 *)src +
-                               mask->range.start);
-       long *d = (long *)((u8 *)dst + mask->range.start);
+       int start = full ? 0 : mask->range.start;
+       int len = full ? sizeof *dst : range_n_bytes(&mask->range);
+       const long *m = (const long *)((const u8 *)&mask->key + start);
+       const long *s = (const long *)((const u8 *)src + start);
+       long *d = (long *)((u8 *)dst + start);
        int i;
 
-       /* The memory outside of the 'mask->range' are not set since
-        * further operations on 'dst' only uses contents within
-        * 'mask->range'.
+       /* If 'full' is true then all of 'dst' is fully initialized. Otherwise,
+        * if 'full' is false the memory outside of the 'mask->range' is left
+        * uninitialized. This can be used as an optimization when further
+        * operations on 'dst' only use contents within 'mask->range'.
         */
-       for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long))
+       for (i = 0; i < len; i += sizeof(long))
                *d++ = *s++ & *m++;
 }
 
@@ -418,7 +419,7 @@ static struct sw_flow *masked_flow_lookup(struct table_instance *ti,
        u32 hash;
        struct sw_flow_key masked_key;
 
-       ovs_flow_mask_key(&masked_key, unmasked, mask);
+       ovs_flow_mask_key(&masked_key, unmasked, false, mask);
        hash = flow_hash(&masked_key, key_start, key_end);
        head = find_bucket(ti, hash);
        hlist_for_each_entry_rcu(flow, head, hash_node[ti->node_ver]) {

diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
index 5918bff7f3f6cfee2fd58bcd15101446b44469d8..2f0cf200ede9db2e0cc1c1b56b7e69e416e2f0a4 100644 (file)
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -82,5 +82,5 @@ bool ovs_flow_cmp_unmasked_key(const struct sw_flow *flow,
                               struct sw_flow_match *match);
 
 void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
-                      const struct sw_flow_mask *mask);
+                      bool full, const struct sw_flow_mask *mask);
 #endif /* flow_table.h */