From: Greg Kroah-Hartman Date: Fri, 9 May 2025 08:57:47 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.183~78 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=071c31aef618dd2a2800b4ca8fe7d29a297a361e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch --- diff --git a/queue-5.10/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch b/queue-5.10/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch new file mode 100644 index 0000000000..cd864fce4d --- /dev/null +++ b/queue-5.10/openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch @@ -0,0 +1,36 @@ +From 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 Mon Sep 17 00:00:00 2001 +From: Eelco Chaudron +Date: Tue, 6 May 2025 16:28:54 +0200 +Subject: openvswitch: Fix unsafe attribute parsing in output_userspace() + +From: Eelco Chaudron + +commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream. + +This patch replaces the manual Netlink attribute iteration in +output_userspace() with nla_for_each_nested(), which ensures that only +well-formed attributes are processed. + +Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") +Signed-off-by: Eelco Chaudron +Acked-by: Ilya Maximets +Acked-by: Aaron Conole +Link: https://patch.msgid.link/0bd65949df61591d9171c0dc13e42cea8941da10.1746541734.git.echaudro@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/actions.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -953,8 +953,7 @@ static int output_userspace(struct datap + upcall.cmd = OVS_PACKET_CMD_ACTION; + upcall.mru = OVS_CB(skb)->mru; + +- for (a = nla_data(attr), rem = nla_len(attr); rem > 0; +- a = nla_next(a, &rem)) { ++ nla_for_each_nested(a, attr, rem) { + switch (nla_type(a)) { + case OVS_USERSPACE_ATTR_USERDATA: + upcall.userdata = a; diff --git a/queue-5.10/series b/queue-5.10/series index 1e4b5122a1..c12ac4e943 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -40,3 +40,4 @@ usb-chipidea-ci_hdrc_imx-implement-usb_phy_init-erro.patch dm-fix-copying-after-src-array-boundaries.patch scsi-target-fix-write_same-no-data-buffer-crash.patch can-mcp251xfd-mcp251xfd_remove-fix-order-of-unregistration-calls.patch +openvswitch-fix-unsafe-attribute-parsing-in-output_userspace.patch