From: Eelco Chaudron Date: Tue, 6 May 2025 14:28:54 +0000 (+0200) Subject: openvswitch: Fix unsafe attribute parsing in output_userspace() X-Git-Tag: v5.10.238~227 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=06b4f110c79716c181a8c5da007c259807840232;p=thirdparty%2Fkernel%2Fstable.git openvswitch: Fix unsafe attribute parsing in output_userspace() commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream. This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Signed-off-by: Eelco Chaudron Acked-by: Ilya Maximets Acked-by: Aaron Conole Link: https://patch.msgid.link/0bd65949df61591d9171c0dc13e42cea8941da10.1746541734.git.echaudro@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index a02ea493c2693..c3ca4ae11c09f 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -953,8 +953,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb, upcall.cmd = OVS_PACKET_CMD_ACTION; upcall.mru = OVS_CB(skb)->mru; - for (a = nla_data(attr), rem = nla_len(attr); rem > 0; - a = nla_next(a, &rem)) { + nla_for_each_nested(a, attr, rem) { switch (nla_type(a)) { case OVS_USERSPACE_ATTR_USERDATA: upcall.userdata = a;