Skip to content

[LTS 9.4] tipc: Fix use-after-free of kernel socket in cleanup_bearer(). #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 18, 2025
Merged

[LTS 9.4] tipc: Fix use-after-free of kernel socket in cleanup_bearer(). #131

merged 1 commit into from
Feb 18, 2025

Conversation

dvdgomez
Copy link

jira VULN-8674
cve CVE-2024-56642
commit-author Kuniyuki Iwashima [email protected]
commit 6a2fa13

syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. [0][1]

When bearer_disable() calls tipc_udp_disable(), cleanup of the UDP kernel socket is deferred by work calling cleanup_bearer().

tipc_net_stop() waits for such works to finish by checking tipc_net(net)->wq_count.  However, the work decrements the count too early before releasing the kernel socket, unblocking cleanup_net() and resulting in use-after-free.

Let's move the decrement after releasing the socket in cleanup_bearer().

[0]:
ref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at
     sk_alloc+0x438/0x608
     inet_create+0x4c8/0xcb0
     __sock_create+0x350/0x6b8
     sock_create_kern+0x58/0x78
     udp_sock_create4+0x68/0x398
     udp_sock_create+0x88/0xc8
     tipc_udp_enable+0x5e8/0x848
     __tipc_nl_bearer_enable+0x84c/0xed8
     tipc_nl_bearer_enable+0x38/0x60
     genl_family_rcv_msg_doit+0x170/0x248
     genl_rcv_msg+0x400/0x5b0
     netlink_rcv_skb+0x1dc/0x398
     genl_rcv+0x44/0x68
     netlink_unicast+0x678/0x8b0
     netlink_sendmsg+0x5e4/0x898
     ____sys_sendmsg+0x500/0x830

[1]:
BUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline] BUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
 udp_hashslot include/net/udp.h:85 [inline]
 udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
 sk_common_release+0xaf/0x3f0 net/core/sock.c:3820
 inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437
 inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489
 __sock_release net/socket.c:658 [inline]
 sock_release+0xa0/0x210 net/socket.c:686
 cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
 kthread+0x531/0x6b0 kernel/kthread.c:389
 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_free_hook mm/slub.c:2269 [inline]
 slab_free mm/slub.c:4580 [inline]
 kmem_cache_free+0x207/0xc40 mm/slub.c:4682
 net_free net/core/net_namespace.c:454 [inline]
 cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
 kthread+0x531/0x6b0 kernel/kthread.c:389
 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: events cleanup_bearer

Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
	Reported-by: syzkaller <[email protected]>
	Signed-off-by: Kuniyuki Iwashima <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Paolo Abeni <[email protected]>

(cherry picked from commit 6a2fa13312e51a621f652d522d7e2df7066330b6)
	Signed-off-by: David Gomez <[email protected]>

Build.log

INSTALL /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/virtio/virtio_snd.ko
  STRIP   /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/virtio/virtio_snd.ko
  SIGN    /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/virtio/virtio_snd.ko
  INSTALL /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  STRIP   /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  SIGN    /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/xen/snd_xen_front.ko
  STRIP   /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/sound/xen/snd_xen_front.ko
  INSTALL /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/virt/lib/irqbypass.ko
  STRIP   /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+
[TIMER]{MODULES}: 39s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+ \
	arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 25s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+ and Index to 0
The default is /boot/loader/entries/7554588dbe7f45cbbd9e84245a2afeb6-5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+
The default is /boot/loader/entries/7554588dbe7f45cbbd9e84245a2afeb6-5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 7s
[TIMER]{BUILD}: 2355s
[TIMER]{MODULES}: 39s
[TIMER]{INSTALL}: 25s
[TIMER]{TOTAL} 2431s

Kernel selftest logs:
With kernel 5.14.0-ciqlts9_4+
kernel-selftest_before.log
With kernel (change applied to lts9.4 branch) 5.14.0-dgomez_ciqlts9_4_CVE-2024-56642+
kernel-selftest_after.log

[dgomez@r94 kernel-src-tree]$ grep '^ok' kernel-selftest_before.log | wc -l
344
[dgomez@r94 kernel-src-tree]$ grep '^ok' kernel-selftest_after.log | wc -l
345
[dgomez@r94 kernel-src-tree]$ grep 'not ok' kernel-selftest_before.log | wc -l
194
[dgomez@r94 kernel-src-tree]$ grep 'not ok' kernel-selftest_after.log | wc -l
193

@dvdgomez
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
b716551 
jira VULN-8674
cve CVE-2024-56642
commit-author Kuniyuki Iwashima <[email protected]>
commit 6a2fa13

syzkaller reported a use-after-free of UDP kernel socket
in cleanup_bearer() without repro. [0][1]

When bearer_disable() calls tipc_udp_disable(), cleanup
of the UDP kernel socket is deferred by work calling
cleanup_bearer().

tipc_net_stop() waits for such works to finish by checking
tipc_net(net)->wq_count.  However, the work decrements the
count too early before releasing the kernel socket,
unblocking cleanup_net() and resulting in use-after-free.

Let's move the decrement after releasing the socket in
cleanup_bearer().

[0]:
ref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at
     sk_alloc+0x438/0x608
     inet_create+0x4c8/0xcb0
     __sock_create+0x350/0x6b8
     sock_create_kern+0x58/0x78
     udp_sock_create4+0x68/0x398
     udp_sock_create+0x88/0xc8
     tipc_udp_enable+0x5e8/0x848
     __tipc_nl_bearer_enable+0x84c/0xed8
     tipc_nl_bearer_enable+0x38/0x60
     genl_family_rcv_msg_doit+0x170/0x248
     genl_rcv_msg+0x400/0x5b0
     netlink_rcv_skb+0x1dc/0x398
     genl_rcv+0x44/0x68
     netlink_unicast+0x678/0x8b0
     netlink_sendmsg+0x5e4/0x898
     ____sys_sendmsg+0x500/0x830

[1]:
BUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline]
BUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
 udp_hashslot include/net/udp.h:85 [inline]
 udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979
 sk_common_release+0xaf/0x3f0 net/core/sock.c:3820
 inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437
 inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489
 __sock_release net/socket.c:658 [inline]
 sock_release+0xa0/0x210 net/socket.c:686
 cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
 kthread+0x531/0x6b0 kernel/kthread.c:389
 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_free_hook mm/slub.c:2269 [inline]
 slab_free mm/slub.c:4580 [inline]
 kmem_cache_free+0x207/0xc40 mm/slub.c:4682
 net_free net/core/net_namespace.c:454 [inline]
 cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310
 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391
 kthread+0x531/0x6b0 kernel/kthread.c:389
 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244

CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: events cleanup_bearer

Fixes: 26abe14 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
	Reported-by: syzkaller <[email protected]>
	Signed-off-by: Kuniyuki Iwashima <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Paolo Abeni <[email protected]>

(cherry picked from commit 6a2fa13)
	Signed-off-by: David Gomez <[email protected]>
@dvdgomez dvdgomez self-assigned this Feb 14, 2025
gvrose8192
gvrose8192 approved these changes Feb 14, 2025
View reviewed changes
Copy link

@gvrose8192 gvrose8192 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems same as others in this CVE series. Pending completion of checks, LGTM and Thanks!

bmastbergen
bmastbergen approved these changes Feb 18, 2025
View reviewed changes
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@dvdgomez dvdgomez merged commit 201ea9b into ciqlts9_4 Feb 18, 2025
4 checks passed
@dvdgomez dvdgomez deleted the dgomez_ciqlts9_4_CVE-2024-56642 branch February 18, 2025 17:03
github-actions bot pushed a commit that referenced this pull request Jun 20, 2025
@faicker-zl @gregkh
net: openvswitch: Fix the dead loop of MPLS parse
69541e5 
[ Upstream commit 0bdc924 ]

The unexpected MPLS packet may not end with the bottom label stack.
When there are many stacks, The label count value has wrapped around.
A dead loop occurs, soft lockup/CPU stuck finally.

stack backtrace:
UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
index -1 is out of range for type '__be32 [3]'
CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
Call Trace:
 <IRQ>
 show_stack+0x52/0x5c
 dump_stack_lvl+0x4a/0x63
 dump_stack+0x10/0x16
 ubsan_epilogue+0x9/0x36
 __ubsan_handle_out_of_bounds.cold+0x44/0x49
 key_extract_l3l4+0x82a/0x840 [openvswitch]
 ? kfree_skbmem+0x52/0xa0
 key_extract+0x9c/0x2b0 [openvswitch]
 ovs_flow_key_extract+0x124/0x350 [openvswitch]
 ovs_vport_receive+0x61/0xd0 [openvswitch]
 ? kernel_init_free_pages.part.0+0x4a/0x70
 ? get_page_from_freelist+0x353/0x540
 netdev_port_receive+0xc4/0x180 [openvswitch]
 ? netdev_port_receive+0x180/0x180 [openvswitch]
 netdev_frame_hook+0x1f/0x40 [openvswitch]
 __netif_receive_skb_core.constprop.0+0x23a/0xf00
 __netif_receive_skb_list_core+0xfa/0x240
 netif_receive_skb_list_internal+0x18e/0x2a0
 napi_complete_done+0x7a/0x1c0
 bnxt_poll+0x155/0x1c0 [bnxt_en]
 __napi_poll+0x30/0x180
 net_rx_action+0x126/0x280
 ? bnxt_msix+0x67/0x80 [bnxt_en]
 handle_softirqs+0xda/0x2d0
 irq_exit_rcu+0x96/0xc0
 common_interrupt+0x8e/0xa0
 </IRQ>

Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
Signed-off-by: Faicker Mo <[email protected]>
Acked-by: Ilya Maximets <[email protected]>
Reviewed-by: Aaron Conole <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
github-actions bot pushed a commit that referenced this pull request Aug 6, 2025
@apconole
net: openvswitch: Fix the dead loop of MPLS parse
c946b20 
JIRA: https://issues.redhat.com/browse/RHEL-95608

commit 0bdc924
Author: Faicker Mo <[email protected]>
Date:   Fri May 23 03:41:43 2025 +0000

    net: openvswitch: Fix the dead loop of MPLS parse

    The unexpected MPLS packet may not end with the bottom label stack.
    When there are many stacks, The label count value has wrapped around.
    A dead loop occurs, soft lockup/CPU stuck finally.

    stack backtrace:
    UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
    index -1 is out of range for type '__be32 [3]'
    CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
    Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
    Call Trace:
     <IRQ>
     show_stack+0x52/0x5c
     dump_stack_lvl+0x4a/0x63
     dump_stack+0x10/0x16
     ubsan_epilogue+0x9/0x36
     __ubsan_handle_out_of_bounds.cold+0x44/0x49
     key_extract_l3l4+0x82a/0x840 [openvswitch]
     ? kfree_skbmem+0x52/0xa0
     key_extract+0x9c/0x2b0 [openvswitch]
     ovs_flow_key_extract+0x124/0x350 [openvswitch]
     ovs_vport_receive+0x61/0xd0 [openvswitch]
     ? kernel_init_free_pages.part.0+0x4a/0x70
     ? get_page_from_freelist+0x353/0x540
     netdev_port_receive+0xc4/0x180 [openvswitch]
     ? netdev_port_receive+0x180/0x180 [openvswitch]
     netdev_frame_hook+0x1f/0x40 [openvswitch]
     __netif_receive_skb_core.constprop.0+0x23a/0xf00
     __netif_receive_skb_list_core+0xfa/0x240
     netif_receive_skb_list_internal+0x18e/0x2a0
     napi_complete_done+0x7a/0x1c0
     bnxt_poll+0x155/0x1c0 [bnxt_en]
     __napi_poll+0x30/0x180
     net_rx_action+0x126/0x280
     ? bnxt_msix+0x67/0x80 [bnxt_en]
     handle_softirqs+0xda/0x2d0
     irq_exit_rcu+0x96/0xc0
     common_interrupt+0x8e/0xa0
     </IRQ>

    Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Signed-off-by: Faicker Mo <[email protected]>
    Acked-by: Ilya Maximets <[email protected]>
    Reviewed-by: Aaron Conole <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>

Signed-off-by: Aaron Conole <[email protected]>
github-actions bot pushed a commit that referenced this pull request Aug 6, 2025
@jcfaracco
Merge: net: openvswitch: Fix the dead loop of MPLS parse
8a50033 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/1046

JIRA: https://issues.redhat.com/browse/RHEL-95608

commit 0bdc924
Author: Faicker Mo <[email protected]>
Date:   Fri May 23 03:41:43 2025 +0000

    net: openvswitch: Fix the dead loop of MPLS parse

    The unexpected MPLS packet may not end with the bottom label stack.
    When there are many stacks, The label count value has wrapped around.
    A dead loop occurs, soft lockup/CPU stuck finally.

    stack backtrace:
    UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
    index -1 is out of range for type '__be32 [3]'
    CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
    Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
    Call Trace:
     <IRQ>
     show_stack+0x52/0x5c
     dump_stack_lvl+0x4a/0x63
     dump_stack+0x10/0x16
     ubsan_epilogue+0x9/0x36
     __ubsan_handle_out_of_bounds.cold+0x44/0x49
     key_extract_l3l4+0x82a/0x840 [openvswitch]
     ? kfree_skbmem+0x52/0xa0
     key_extract+0x9c/0x2b0 [openvswitch]
     ovs_flow_key_extract+0x124/0x350 [openvswitch]
     ovs_vport_receive+0x61/0xd0 [openvswitch]
     ? kernel_init_free_pages.part.0+0x4a/0x70
     ? get_page_from_freelist+0x353/0x540
     netdev_port_receive+0xc4/0x180 [openvswitch]
     ? netdev_port_receive+0x180/0x180 [openvswitch]
     netdev_frame_hook+0x1f/0x40 [openvswitch]
     __netif_receive_skb_core.constprop.0+0x23a/0xf00
     __netif_receive_skb_list_core+0xfa/0x240
     netif_receive_skb_list_internal+0x18e/0x2a0
     napi_complete_done+0x7a/0x1c0
     bnxt_poll+0x155/0x1c0 [bnxt_en]
     __napi_poll+0x30/0x180
     net_rx_action+0x126/0x280
     ? bnxt_msix+0x67/0x80 [bnxt_en]
     handle_softirqs+0xda/0x2d0
     irq_exit_rcu+0x96/0xc0
     common_interrupt+0x8e/0xa0
     </IRQ>

    Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Signed-off-by: Faicker Mo <[email protected]>
    Acked-by: Ilya Maximets <[email protected]>
    Reviewed-by: Aaron Conole <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>

Signed-off-by: Aaron Conole <[email protected]>

Approved-by: Paolo Abeni <[email protected]>
Approved-by: Antoine Tenart <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Julio Faracco <[email protected]>
github-actions bot pushed a commit that referenced this pull request Aug 7, 2025
@apconole
net: openvswitch: Fix the dead loop of MPLS parse
009f40e 
JIRA: https://issues.redhat.com/browse/RHEL-95607

commit 0bdc924
Author: Faicker Mo <[email protected]>
Date:   Fri May 23 03:41:43 2025 +0000

    net: openvswitch: Fix the dead loop of MPLS parse

    The unexpected MPLS packet may not end with the bottom label stack.
    When there are many stacks, The label count value has wrapped around.
    A dead loop occurs, soft lockup/CPU stuck finally.

    stack backtrace:
    UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
    index -1 is out of range for type '__be32 [3]'
    CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
    Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
    Call Trace:
     <IRQ>
     show_stack+0x52/0x5c
     dump_stack_lvl+0x4a/0x63
     dump_stack+0x10/0x16
     ubsan_epilogue+0x9/0x36
     __ubsan_handle_out_of_bounds.cold+0x44/0x49
     key_extract_l3l4+0x82a/0x840 [openvswitch]
     ? kfree_skbmem+0x52/0xa0
     key_extract+0x9c/0x2b0 [openvswitch]
     ovs_flow_key_extract+0x124/0x350 [openvswitch]
     ovs_vport_receive+0x61/0xd0 [openvswitch]
     ? kernel_init_free_pages.part.0+0x4a/0x70
     ? get_page_from_freelist+0x353/0x540
     netdev_port_receive+0xc4/0x180 [openvswitch]
     ? netdev_port_receive+0x180/0x180 [openvswitch]
     netdev_frame_hook+0x1f/0x40 [openvswitch]
     __netif_receive_skb_core.constprop.0+0x23a/0xf00
     __netif_receive_skb_list_core+0xfa/0x240
     netif_receive_skb_list_internal+0x18e/0x2a0
     napi_complete_done+0x7a/0x1c0
     bnxt_poll+0x155/0x1c0 [bnxt_en]
     __napi_poll+0x30/0x180
     net_rx_action+0x126/0x280
     ? bnxt_msix+0x67/0x80 [bnxt_en]
     handle_softirqs+0xda/0x2d0
     irq_exit_rcu+0x96/0xc0
     common_interrupt+0x8e/0xa0
     </IRQ>

    Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Signed-off-by: Faicker Mo <[email protected]>
    Acked-by: Ilya Maximets <[email protected]>
    Reviewed-by: Aaron Conole <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>

Signed-off-by: Aaron Conole <[email protected]>
github-actions bot pushed a commit that referenced this pull request Aug 7, 2025
@caringi
Merge: net: openvswitch: Fix the dead loop of MPLS parse
15384ba 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6995

JIRA: https://issues.redhat.com/browse/RHEL-95607

commit 0bdc924
Author: Faicker Mo <[email protected]>
Date:   Fri May 23 03:41:43 2025 +0000

    net: openvswitch: Fix the dead loop of MPLS parse

    The unexpected MPLS packet may not end with the bottom label stack.
    When there are many stacks, The label count value has wrapped around.
    A dead loop occurs, soft lockup/CPU stuck finally.

    stack backtrace:
    UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
    index -1 is out of range for type '__be32 [3]'
    CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
    Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
    Call Trace:
     <IRQ>
     show_stack+0x52/0x5c
     dump_stack_lvl+0x4a/0x63
     dump_stack+0x10/0x16
     ubsan_epilogue+0x9/0x36
     __ubsan_handle_out_of_bounds.cold+0x44/0x49
     key_extract_l3l4+0x82a/0x840 [openvswitch]
     ? kfree_skbmem+0x52/0xa0
     key_extract+0x9c/0x2b0 [openvswitch]
     ovs_flow_key_extract+0x124/0x350 [openvswitch]
     ovs_vport_receive+0x61/0xd0 [openvswitch]
     ? kernel_init_free_pages.part.0+0x4a/0x70
     ? get_page_from_freelist+0x353/0x540
     netdev_port_receive+0xc4/0x180 [openvswitch]
     ? netdev_port_receive+0x180/0x180 [openvswitch]
     netdev_frame_hook+0x1f/0x40 [openvswitch]
     __netif_receive_skb_core.constprop.0+0x23a/0xf00
     __netif_receive_skb_list_core+0xfa/0x240
     netif_receive_skb_list_internal+0x18e/0x2a0
     napi_complete_done+0x7a/0x1c0
     bnxt_poll+0x155/0x1c0 [bnxt_en]
     __napi_poll+0x30/0x180
     net_rx_action+0x126/0x280
     ? bnxt_msix+0x67/0x80 [bnxt_en]
     handle_softirqs+0xda/0x2d0
     irq_exit_rcu+0x96/0xc0
     common_interrupt+0x8e/0xa0
     </IRQ>

    Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Signed-off-by: Faicker Mo <[email protected]>
    Acked-by: Ilya Maximets <[email protected]>
    Reviewed-by: Aaron Conole <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>

Signed-off-by: Aaron Conole <[email protected]>

Approved-by: Xin Long <[email protected]>
Approved-by: Antoine Tenart <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Augusto Caringi <[email protected]>
PlaidCat added a commit that referenced this pull request Oct 3, 2025
@PlaidCat
net: openvswitch: Fix the dead loop of MPLS parse
a32b08c 
jira LE-4321
Rebuild_History Non-Buildable kernel-4.18.0-553.77.1.el8_10
commit-author Faicker Mo <[email protected]>
commit 0bdc924

The unexpected MPLS packet may not end with the bottom label stack.
When there are many stacks, The label count value has wrapped around.
A dead loop occurs, soft lockup/CPU stuck finally.

stack backtrace:
UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
index -1 is out of range for type '__be32 [3]'
CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
Call Trace:
 <IRQ>
 show_stack+0x52/0x5c
 dump_stack_lvl+0x4a/0x63
 dump_stack+0x10/0x16
 ubsan_epilogue+0x9/0x36
 __ubsan_handle_out_of_bounds.cold+0x44/0x49
 key_extract_l3l4+0x82a/0x840 [openvswitch]
 ? kfree_skbmem+0x52/0xa0
 key_extract+0x9c/0x2b0 [openvswitch]
 ovs_flow_key_extract+0x124/0x350 [openvswitch]
 ovs_vport_receive+0x61/0xd0 [openvswitch]
 ? kernel_init_free_pages.part.0+0x4a/0x70
 ? get_page_from_freelist+0x353/0x540
 netdev_port_receive+0xc4/0x180 [openvswitch]
 ? netdev_port_receive+0x180/0x180 [openvswitch]
 netdev_frame_hook+0x1f/0x40 [openvswitch]
 __netif_receive_skb_core.constprop.0+0x23a/0xf00
 __netif_receive_skb_list_core+0xfa/0x240
 netif_receive_skb_list_internal+0x18e/0x2a0
 napi_complete_done+0x7a/0x1c0
 bnxt_poll+0x155/0x1c0 [bnxt_en]
 __napi_poll+0x30/0x180
 net_rx_action+0x126/0x280
 ? bnxt_msix+0x67/0x80 [bnxt_en]
 handle_softirqs+0xda/0x2d0
 irq_exit_rcu+0x96/0xc0
 common_interrupt+0x8e/0xa0
 </IRQ>

Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
	Signed-off-by: Faicker Mo <[email protected]>
	Acked-by: Ilya Maximets <[email protected]>
	Reviewed-by: Aaron Conole <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Paolo Abeni <[email protected]>

(cherry picked from commit 0bdc924)
	Signed-off-by: Jonathan Maple <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bmastbergen bmastbergen bmastbergen approved these changes

@PlaidCat PlaidCat Awaiting requested review from PlaidCat

+1 more reviewer

@gvrose8192 gvrose8192 gvrose8192 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@dvdgomez dvdgomez

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dvdgomez @gvrose8192 @bmastbergen