openvswitch: cap upcall PID array size and pre-size vport replies

The vport netlink reply helpers allocate a fixed-size skb with
nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID
array via ovs_vport_get_upcall_portids(). Since
ovs_vport_set_upcall_portids() accepts any non-zero multiple of
sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID
array large enough to overflow the reply buffer, causing nla_put() to
fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with
unprivileged user namespaces enabled (e.g., Ubuntu default), this is
reachable via unshare -Urn since OVS vport mutation operations use
GENL_UNS_ADMIN_PERM.

kernel BUG at net/openvswitch/datapath.c:2414!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1
RIP: 0010:ovs_vport_cmd_set+0x34c/0x400
Call Trace:
<TASK>
genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116)
genl_rcv_msg (net/netlink/genetlink.c:1194)
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
genl_rcv (net/netlink/genetlink.c:1219)
netlink_unicast (net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sys_sendto (net/socket.c:2206)
__x64_sys_sendto (net/socket.c:2209)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
Kernel panic - not syncing: Fatal exception

Reject attempts to set more PIDs than nr_cpu_ids in
ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply
size in ovs_vport_cmd_msg_size() based on that bound, similar to the
existing ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already
used by the per-CPU dispatch configuration on the datapath side
(ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the
two sides stay consistent.

Fixes: 5cd667b0a456 ("openvswitch: Allow each vport to have an array of 'port_id's.")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260416024653.153456-2-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Weiming Shi and committed by

Jakub Kicinski 2 months ago 2091c6aa d03fc81a

+36 -2

2 changed files

expand all

net

openvswitch

datapath.c

vport.c

+33 -2

net/openvswitch/datapath.c

··· 2184 2184 return err; 2185 2185 } 2186 2186 2187 + static size_t ovs_vport_cmd_msg_size(void) 2188 + { 2189 + size_t msgsize = NLMSG_ALIGN(sizeof(struct ovs_header)); 2190 + 2191 + msgsize += nla_total_size(sizeof(u32)); /* OVS_VPORT_ATTR_PORT_NO */ 2192 + msgsize += nla_total_size(sizeof(u32)); /* OVS_VPORT_ATTR_TYPE */ 2193 + msgsize += nla_total_size(IFNAMSIZ); /* OVS_VPORT_ATTR_NAME */ 2194 + msgsize += nla_total_size(sizeof(u32)); /* OVS_VPORT_ATTR_IFINDEX */ 2195 + msgsize += nla_total_size(sizeof(s32)); /* OVS_VPORT_ATTR_NETNSID */ 2196 + 2197 + /* OVS_VPORT_ATTR_STATS */ 2198 + msgsize += nla_total_size_64bit(sizeof(struct ovs_vport_stats)); 2199 + 2200 + /* OVS_VPORT_ATTR_UPCALL_STATS(OVS_VPORT_UPCALL_ATTR_SUCCESS + 2201 + * OVS_VPORT_UPCALL_ATTR_FAIL) 2202 + */ 2203 + msgsize += nla_total_size(nla_total_size_64bit(sizeof(u64)) + 2204 + nla_total_size_64bit(sizeof(u64))); 2205 + 2206 + /* OVS_VPORT_ATTR_UPCALL_PID */ 2207 + msgsize += nla_total_size(nr_cpu_ids * sizeof(u32)); 2208 + 2209 + /* OVS_VPORT_ATTR_OPTIONS(OVS_TUNNEL_ATTR_DST_PORT + 2210 + * OVS_TUNNEL_ATTR_EXTENSION(OVS_VXLAN_EXT_GBP)) 2211 + */ 2212 + msgsize += nla_total_size(nla_total_size(sizeof(u16)) + 2213 + nla_total_size(nla_total_size(0))); 2214 + 2215 + return msgsize; 2216 + } 2217 + 2187 2218 static struct sk_buff *ovs_vport_cmd_alloc_info(void) 2188 2219 { 2189 - return nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2220 + return genlmsg_new(ovs_vport_cmd_msg_size(), GFP_KERNEL); 2190 2221 } 2191 2222 2192 2223 /* Called with ovs_mutex, only via ovs_dp_notify_wq(). */ ··· 2227 2196 struct sk_buff *skb; 2228 2197 int retval; 2229 2198 2230 - skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2199 + skb = ovs_vport_cmd_alloc_info(); 2231 2200 if (!skb) 2232 2201 return ERR_PTR(-ENOMEM); 2233 2202

net/openvswitch/vport.c

··· 406 406 if (!nla_len(ids) || nla_len(ids) % sizeof(u32)) 407 407 return -EINVAL; 408 408 409 + if (nla_len(ids) / sizeof(u32) > nr_cpu_ids) 410 + return -EINVAL; 411 + 409 412 old = ovsl_dereference(vport->upcall_portids); 410 413 411 414 vport_portids = kmalloc(sizeof(*vport_portids) + nla_len(ids),

Configure Feed

Configure Feed