linux-stable.git/net/openvswitch, branch linux-3.16.y

openvswitch: remove another BUG_ON()

2020-02-11T20:03:52+00:00

commit 8a574f86652a4540a2433946ba826ccb87f398cc upstream.

If we can't build the flow del notification, we can simply delete
the flow, no need to crash the kernel. Still keep a WARN_ON to
preserve debuggability.

Note: the BUG_ON() predates the Fixes tag, but this change
can be applied only after the mentioned commit.

v1 -> v2:
 - do not leak an skb on error

Fixes: aed067783e50 ("openvswitch: Minimize ovs_flow_cmd_del critical section.")
Signed-off-by: Paolo Abeni 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()

2020-02-11T20:03:52+00:00

commit 8ffeb03fbba3b599690b361467bfd2373e8c450f upstream.

All the callers of ovs_flow_cmd_build_info() already deal with
error return code correctly, so we can handle the error condition
in a more gracefull way. Still dump a warning to preserve
debuggability.

v1 -> v2:
 - clarify the commit message
 - clean the skb and report the error (DaveM)

Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
Signed-off-by: Paolo Abeni 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

ovs: do not allocate memory from offline numa node

2015-10-28T10:33:20+00:00

commit 598c12d0ba6de9060f04999746eb1e015774044b upstream.

When openvswitch tries allocate memory from offline numa node 0:
stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0)
It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid))
[ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h
This patch disables numa affinity in this case.

Signed-off-by: Konstantin Khlebnikov 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller 
Signed-off-by: Luis Henriques

openvswitch: Zero flows on allocation.

2015-09-30T12:20:58+00:00

commit ae5f2fb1d51fa128a460bcfbe3c56d7ab8bf6a43 upstream.

When support for megaflows was introduced, OVS needed to start
installing flows with a mask applied to them. Since masking is an
expensive operation, OVS also had an optimization that would only
take the parts of the flow keys that were covered by a non-zero
mask. The values stored in the remaining pieces should not matter
because they are masked out.

While this works fine for the purposes of matching (which must always
look at the mask), serialization to netlink can be problematic. Since
the flow and the mask are serialized separately, the uninitialized
portions of the flow can be encoded with whatever values happen to be
present.

In terms of functionality, this has little effect since these fields
will be masked out by definition. However, it leaks kernel memory to
userspace, which is a potential security vulnerability. It is also
possible that other code paths could look at the masked key and get
uninitialized data, although this does not currently appear to be an
issue in practice.

This removes the mask optimization for flows that are being installed.
This was always intended to be the case as the mask optimizations were
really targetting per-packet flow operations.

Fixes: 03f0d916 ("openvswitch: Mega flow implementation")
Signed-off-by: Jesse Gross 
Acked-by: Pravin B Shelar 
Signed-off-by: David S. Miller 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

net: make skb_gso_segment error handling more robust

2015-05-20T12:25:55+00:00

commit 330966e501ffe282d7184fde4518d5e0c24bc7f8 upstream.

skb_gso_segment has three possible return values:
1. a pointer to the first segmented skb
2. an errno value (IS_ERR())
3. NULL.  This can happen when GSO is used for header verification.

However, several callers currently test IS_ERR instead of IS_ERR_OR_NULL
and would oops when NULL is returned.

Note that these call sites should never actually see such a NULL return
value; all callers mask out the GSO bits in the feature argument.

However, there have been issues with some protocol handlers erronously not
respecting the specified feature mask in some cases.

It is preferable to get 'have to turn off hw offloading, else slow' reports
rather than 'kernel crashes'.

Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller 
Cc: Ben Hutchings 
Signed-off-by: Luis Henriques

openvswitch: Fix net exit.

2015-03-12T16:27:32+00:00

commit 7b4577a9da3702049650f7095506e9afd9f68849 upstream.

Open vSwitch allows moving internal vport to different namespace
while still connected to the bridge. But when namespace deleted
OVS does not detach these vports, that results in dangling
pointer to netdevice which causes kernel panic as follows.
This issue is fixed by detaching all ovs ports from the deleted
namespace at net-exit.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
IP: [] ovs_vport_locate+0x35/0x80 [openvswitch]
Oops: 0000 [#1] SMP
Call Trace:
 [] lookup_vport+0x21/0xd0 [openvswitch]
 [] ovs_vport_cmd_get+0x59/0xf0 [openvswitch]
 [] genl_family_rcv_msg+0x1bc/0x3e0
 [] genl_rcv_msg+0x79/0xc0
 [] netlink_rcv_skb+0xb9/0xe0
 [] genl_rcv+0x2c/0x40
 [] netlink_unicast+0x12d/0x1c0
 [] netlink_sendmsg+0x34a/0x6b0
 [] sock_sendmsg+0xa0/0xe0
 [] ___sys_sendmsg+0x408/0x420
 [] __sys_sendmsg+0x51/0x90
 [] SyS_sendmsg+0x12/0x20
 [] system_call_fastpath+0x12/0x17

Reported-by: Assaf Muller 
Fixes: 46df7b81454("openvswitch: Add support for network namespaces.")
Signed-off-by: Pravin B Shelar 
Reviewed-by: Thomas Graf 
Signed-off-by: David S. Miller 
Signed-off-by: Luis Henriques

openvswitch: fix panic with multiple vlan headers

2014-10-15T10:05:27+00:00

[ Upstream commit 2ba5af42a7b59ef01f9081234d8855140738defd ]

When there are multiple vlan headers present in a received frame, the first
one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the
skb beyond the VLAN TPID may be still non-linear, including the inner TCI
and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it
does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is
executed, __pop_vlan_tci pulls the next vlan header into vlan_tci.

This leads to two things:

1. Part of the resulting ethernet header is in the non-linear part of the
   skb. When eth_type_trans is called later as the result of
   OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci
   is in fact accessing random data when it reads past the TPID.

2. network_header points into the ethernet header instead of behind it.
   mac_len is set to a wrong value (10), too.

Reported-by: Yulong Pei 
Signed-off-by: Jiri Benc 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

openvswitch: Use exact lookup for flow_get and flow_del.

2014-07-01T03:47:15+00:00

Due to the race condition in userspace, there is chance that two
overlapping megaflows could be installed in datapath.  And this
causes userspace unable to delete the less inclusive megaflow flow
even after it timeout, since the flow_del logic will stop at the
first match of masked flow.

This commit fixes the bug by making the kernel flow_del and flow_get
logic check all masks in that case.

Introduced by 03f0d916a (openvswitch: Mega flow implementation).

Signed-off-by: Alex Wang 
Acked-by: Andy Zhou 
Signed-off-by: Pravin B Shelar

openvswitch: Fix tracking of flags seen in TCP flows.

2014-06-29T21:10:51+00:00

Flow statistics need to take into account the TCP flags from the packet
currently being processed (in 'key'), not the TCP flags matched by the
flow found in the kernel flow table (in 'flow').

This bug made the Open vSwitch userspace fin_timeout action have no effect
in many cases.
This bug is introduced by commit 88d73f6c411ac2f0578 (openvswitch: Use
TCP flags in the flow key for stats.)

Reported-by: Len Gao 
Signed-off-by: Ben Pfaff 
Acked-by: Jarno Rajahalme 
Acked-by: Jesse Gross 
Signed-off-by: Pravin B Shelar

openvswitch: supply a dummy err_handler of gre_cisco_protocol to prevent kernel crash

2014-06-29T21:10:48+00:00

When use gre vport, openvswitch register a gre_cisco_protocol but
does not supply a err_handler with it. The gre_cisco_err() in
net/ipv4/gre_demux.c expect err_handler be provided with the
gre_cisco_protocol implementation, and call ->err_handler() without
existence check, cause the kernel crash.

This patch provide a err_handler to fix this bug.
This bug introduced by commit aa310701e787087d (openvswitch: Add gre
tunnel support.)

Signed-off-by: Wei Zhang 
Signed-off-by: Jesse Gross 
Signed-off-by: Pravin B Shelar