Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2222410/?format=api
{ "id": 2222410, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2222410/?format=api", "web_url": "http://patchwork.ozlabs.org/project/openvswitch/patch/20260411055915.1224902-2-bestswngs@gmail.com/", "project": { "id": 47, "url": "http://patchwork.ozlabs.org/api/1.1/projects/47/?format=api", "name": "Open vSwitch", "link_name": "openvswitch", "list_id": "ovs-dev.openvswitch.org", "list_email": "ovs-dev@openvswitch.org", "web_url": "http://openvswitch.org/", "scm_url": "git@github.com:openvswitch/ovs.git", "webscm_url": "https://github.com/openvswitch/ovs" }, "msgid": "<20260411055915.1224902-2-bestswngs@gmail.com>", "date": "2026-04-11T05:59:16", "name": "[ovs-dev,net] openvswitch: fix kernel panic from oversized vport upcall PID arrays", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": false, "hash": "48b9e29e3f109c5f904321dd095ad1c484b1aed3", "submitter": { "id": 92941, "url": "http://patchwork.ozlabs.org/api/1.1/people/92941/?format=api", "name": "Weiming Shi", "email": "bestswngs@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/openvswitch/patch/20260411055915.1224902-2-bestswngs@gmail.com/mbox/", "series": [ { "id": 499555, "url": "http://patchwork.ozlabs.org/api/1.1/series/499555/?format=api", "web_url": "http://patchwork.ozlabs.org/project/openvswitch/list/?series=499555", "date": "2026-04-11T05:59:16", "name": "[ovs-dev,net] openvswitch: fix kernel panic from oversized vport upcall PID arrays", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499555/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2222410/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2222410/checks/", "tags": {}, "headers": { "Return-Path": "<ovs-dev-bounces@openvswitch.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "dev@openvswitch.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "ovs-dev@lists.linuxfoundation.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=POVSgLxK;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)", "smtp1.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104\n header.b=POVSgLxK", "smtp2.osuosl.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp2.osuosl.org; dkim=pass (2048-bit key,\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=POVSgLxK" ], "Received": [ "from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4ftCtZ3ylYz1y2d\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 11 Apr 2026 22:40:06 +1000 (AEST)", "from localhost (localhost [127.0.0.1])\n\tby smtp1.osuosl.org (Postfix) with ESMTP id F180880AB3;\n\tSat, 11 Apr 2026 12:40:01 +0000 (UTC)", "from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id ElqCyVX8V3kT; Sat, 11 Apr 2026 12:40:00 +0000 (UTC)", "from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp1.osuosl.org (Postfix) with ESMTPS id 552E0809B5;\n\tSat, 11 Apr 2026 12:40:00 +0000 (UTC)", "from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 1B0E1C054A;\n\tSat, 11 Apr 2026 12:40:00 +0000 (UTC)", "from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133])\n by lists.linuxfoundation.org (Postfix) with ESMTP id 394ECC0549\n for <dev@openvswitch.org>; Sat, 11 Apr 2026 05:59:53 +0000 (UTC)", "from localhost (localhost [127.0.0.1])\n by smtp2.osuosl.org (Postfix) with ESMTP id 1FAD2403F3\n for <dev@openvswitch.org>; Sat, 11 Apr 2026 05:59:53 +0000 (UTC)", "from smtp2.osuosl.org ([127.0.0.1])\n by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id L0rosW7DTSGK for <dev@openvswitch.org>;\n Sat, 11 Apr 2026 05:59:52 +0000 (UTC)", "from mail-dl1-x1230.google.com (mail-dl1-x1230.google.com\n [IPv6:2607:f8b0:4864:20::1230])\n by smtp2.osuosl.org (Postfix) with ESMTPS id 357624008E\n for <dev@openvswitch.org>; Sat, 11 Apr 2026 05:59:51 +0000 (UTC)", "by mail-dl1-x1230.google.com with SMTP id\n a92af1059eb24-12c1fcce8f8so2998399c88.1\n for <dev@openvswitch.org>; Fri, 10 Apr 2026 22:59:51 -0700 (PDT)", "from efaec68ba852.tailc0aff1.ts.net ([206.206.192.132])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12c34acb077sm5793482c88.6.2026.04.10.22.59.48\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 10 Apr 2026 22:59:50 -0700 (PDT)" ], "X-Virus-Scanned": [ "amavis at osuosl.org", "amavis at osuosl.org" ], "X-Comment": "SPF check N/A for local connections -\n client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=<UNKNOWN> ", "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 smtp1.osuosl.org 552E0809B5", "OpenDKIM Filter v2.11.0 smtp2.osuosl.org 357624008E" ], "Received-SPF": "Pass (mailfrom) identity=mailfrom;\n client-ip=2607:f8b0:4864:20::1230; helo=mail-dl1-x1230.google.com;\n envelope-from=bestswngs@gmail.com; receiver=<UNKNOWN>", "DMARC-Filter": "OpenDMARC Filter v1.4.2 smtp2.osuosl.org 357624008E", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1775887191; x=1776491991; darn=openvswitch.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=0ECEJ7N7pSGGDGib0bgAOerxrVcm8lCH9jDWjAKSBVo=;\n b=POVSgLxKJnrNc5I6e8gQM57FpGmFvx4kkNgCrp4sr+0epPH7jOJ+17laHw/C3CRC0Q\n TYiH1gJwbM4yRBlL3ixQjb9nr/u80+hKzbQMu0ktfrp4JrLzr4gky1j2VhCoJs537DcJ\n /2tjJogCk9oISApHUfqbWaZ/Ap5pb2/8o+drQymDvAsgM6hEMeMRbJwVOiezym296ITb\n jcNIIl0oEceo7QU1pKv+2/KfdxNgRDpObRaZwA9fwS8htpXH9oXMkXKBy3dzZdoRc34r\n HNrMnQvJIS8RtX1bTG7zd6mB/8sVKt/Wq6fO0ivTRhgsoL0wYa7WYM9a3tuTxrb8jUZE\n vr8A==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775887191; x=1776491991;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=0ECEJ7N7pSGGDGib0bgAOerxrVcm8lCH9jDWjAKSBVo=;\n b=C6XdQ0TkXHmerO8gDVn6eMuKRSQ/E6zw8JBSTJK4/wyu0HXFNCljnRSlsP+xy8Fk3a\n MdPJYjnGOg5I+fd408lX85CNlshDM4+HYFHRQtHTpj1qmB7VvqOGIgG4oBsKX9f5o2/m\n /8DJgwvtpZ6yTH0cmZOidJHiBYKku3yjvxUoL1vkcLNeiuLbxM1mH4/IZnDqJQ6I8rEf\n NtFH24hpFman5IdO0sv97UH2KrMGFSrP7Bkb7atlQuQyNcDPwVEbja9czibbK2iC39R6\n HV6tly9YxM7ErO6A83978cbwQ5V9OgkcajpBSPZ1Ki+HdV4+jWiJevUIIy2CiCT/fxzC\n pmNg==", "X-Forwarded-Encrypted": "i=1;\n AJvYcCXOvJXDHQ5eE8yVqh6taJnl4/jY2hbX256/rNtET07eHl/4Kleuhyj5OKDR/1Ej0BT5TlU=@openvswitch.org", "X-Gm-Message-State": "AOJu0YzuLNID+R1xMlMdke2A+KuQ/QJ7DFBdZHi1s9v1/53O6l5rfUAc\n 2W9pyemSlUWNygB1WcxQruIbYPTqBVUBj0UkK4YHj0DvqjZ7+CagN0mG", "X-Gm-Gg": "AeBDietHFIcPUoqZxiSlx2BhCP3Vfixq28awYOH0aokeQeKWCvDi1k/x3KCCc5CwUxO\n C1QqvX5+2AqyB8aApiDvsnD04VyLe7sEYzZIEPimCeXZkzRbrGwWBlMlNv8fH/LdrCxQvU5BbfA\n ceI70oTroYsClafEy9zKunwBWDk3lSgXnn9Bibx3PLUQVh5ErZgs+pj9wwXENSXhI0D5NNlDvmp\n +10OsHHrDdJWFb8vaiSeHjK/BgPYMG0yEIF+4ynnlkG+0yiynliX69Dccd8o9x6oMAvrAGPDVjg\n S1klcUc9Xw/idJ+q4oeWVy4KIDePa65HUr0OXf0exY/ccETFG7EcHg9dqsCwj432gQIEidTVZFH\n apqI7LM1miLilRY18FunTXMlfXQ23yoh650rLyY3U5BRedLmyl7X5qmG2e8OXDtBNooitKycG8e\n NmC93ppRlA24asqxQXEi4EGc2I1Wb1EPfjOpaL+oG/nC8CDjgy+dkB+nNgx5NA8UCbq6WZ0Bnmp\n Hi2LZvyeg==", "X-Received": "by 2002:a05:7022:628c:b0:128:d438:cad with SMTP id\n a92af1059eb24-12c34ede1e6mr3760909c88.18.1775887190883;\n Fri, 10 Apr 2026 22:59:50 -0700 (PDT)", "From": "Weiming Shi <bestswngs@gmail.com>", "To": "Aaron Conole <aconole@redhat.com>, Eelco Chaudron <echaudro@redhat.com>,\n Ilya Maximets <i.maximets@ovn.org>,\n \"David S . Miller\" <davem@davemloft.net>,\n Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>,\n Paolo Abeni <pabeni@redhat.com>", "Date": "Fri, 10 Apr 2026 22:59:16 -0700", "Message-ID": "<20260411055915.1224902-2-bestswngs@gmail.com>", "X-Mailer": "git-send-email 2.43.0", "MIME-Version": "1.0", "X-Mailman-Approved-At": "Sat, 11 Apr 2026 12:39:58 +0000", "Subject": "[ovs-dev] [PATCH net] openvswitch: fix kernel panic from oversized\n vport upcall PID arrays", "X-BeenThere": "ovs-dev@openvswitch.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "<ovs-dev.openvswitch.org>", "List-Unsubscribe": "<https://mail.openvswitch.org/mailman/options/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=unsubscribe>", "List-Archive": "<http://mail.openvswitch.org/pipermail/ovs-dev/>", "List-Post": "<mailto:ovs-dev@openvswitch.org>", "List-Help": "<mailto:ovs-dev-request@openvswitch.org?subject=help>", "List-Subscribe": "<https://mail.openvswitch.org/mailman/listinfo/ovs-dev>,\n <mailto:ovs-dev-request@openvswitch.org?subject=subscribe>", "Cc": "dev@openvswitch.org, netdev@vger.kernel.org, Xiang Mei <xmei5@asu.edu>,\n Mark Gray <mark.d.gray@redhat.com>, linux-kernel@vger.kernel.org,\n Weiming Shi <bestswngs@gmail.com>, Flavio Leitner <fbl@sysclose.org>,\n Simon Horman <horms@kernel.org>", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "ovs-dev-bounces@openvswitch.org", "Sender": "\"dev\" <ovs-dev-bounces@openvswitch.org>" }, "content": "The vport netlink reply helpers allocate a fixed-size skb with\nnlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID\narray via ovs_vport_get_upcall_portids(). Since\novs_vport_set_upcall_portids() accepts any non-zero multiple of\nsizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a\nPID array large enough to overflow the reply buffer. When the\nsubsequent nla_put() fails with -EMSGSIZE, five BUG_ON(err < 0) sites\nfire and panic the kernel. On systems with unprivileged user namespaces\nenabled (e.g., Ubuntu default), this is reachable via unshare -Urn.\n\n kernel BUG at net/openvswitch/datapath.c:2414!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1\n RIP: 0010:ovs_vport_cmd_set (net/openvswitch/datapath.c:2414 (discriminator 1))\n Call Trace:\n <TASK>\n genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116)\n genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n genl_rcv (net/netlink/genetlink.c:1219)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n __sys_sendto (net/socket.c:2206 (discriminator 1))\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n Kernel panic - not syncing: Fatal exception\n\nDynamically compute the reply skb size based on the vport's actual PID\narray length instead of using a fixed NLMSG_DEFAULT_SIZE, and replace\nthe BUG_ON() calls with WARN_ON_ONCE() plus graceful error returns.\n\nFixes: b83d23a2a38b (\"openvswitch: Introduce per-cpu upcall dispatch\")\nReported-by: Xiang Mei <xmei5@asu.edu>\nSigned-off-by: Weiming Shi <bestswngs@gmail.com>\n---\n net/openvswitch/datapath.c | 95 ++++++++++++++++++++++++++------------\n 1 file changed, 66 insertions(+), 29 deletions(-)", "diff": "diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c\nindex e209099218b4..3649a1f2a3f5 100644\n--- a/net/openvswitch/datapath.c\n+++ b/net/openvswitch/datapath.c\n@@ -2184,9 +2184,17 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,\n \treturn err;\n }\n \n-static struct sk_buff *ovs_vport_cmd_alloc_info(void)\n+/* Must be called with ovs_mutex or rcu_read_lock. */\n+static size_t ovs_vport_cmd_msg_size(const struct vport *vport)\n {\n-\treturn nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);\n+\tconst struct vport_portids *ids;\n+\tsize_t msgsize = NLMSG_DEFAULT_SIZE;\n+\n+\tids = rcu_dereference_ovsl(vport->upcall_portids);\n+\tif (ids && (vport->dp->user_features & OVS_DP_F_VPORT_PIDS))\n+\t\tmsgsize += ids->n_ids * sizeof(u32);\n+\n+\treturn msgsize;\n }\n \n /* Called with ovs_mutex, only via ovs_dp_notify_wq(). */\n@@ -2196,13 +2204,16 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,\n \tstruct sk_buff *skb;\n \tint retval;\n \n-\tskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);\n+\tskb = nlmsg_new(ovs_vport_cmd_msg_size(vport), GFP_KERNEL);\n \tif (!skb)\n \t\treturn ERR_PTR(-ENOMEM);\n \n \tretval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd,\n \t\t\t\t\t GFP_KERNEL);\n-\tBUG_ON(retval < 0);\n+\tif (WARN_ON_ONCE(retval < 0)) {\n+\t\tkfree_skb(skb);\n+\t\treturn ERR_PTR(retval);\n+\t}\n \n \treturn skb;\n }\n@@ -2303,7 +2314,8 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)\n \tif (port_no >= DP_MAX_PORTS)\n \t\treturn -EFBIG;\n \n-\treply = ovs_vport_cmd_alloc_info();\n+\treply = genlmsg_new(NLMSG_DEFAULT_SIZE +\n+\t\t\t nla_len(a[OVS_VPORT_ATTR_UPCALL_PID]), GFP_KERNEL);\n \tif (!reply)\n \t\treturn -ENOMEM;\n \n@@ -2358,7 +2370,9 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)\n \telse\n \t\tnetdev_set_rx_headroom(vport->dev, dp->max_headroom);\n \n-\tBUG_ON(err < 0);\n+\tif (WARN_ON_ONCE(err < 0))\n+\t\tgoto exit_unlock_free;\n+\n \tovs_unlock();\n \n \tovs_notify(&dp_vport_genl_family, reply, info);\n@@ -2377,49 +2391,52 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)\n \tstruct vport *vport;\n \tint err;\n \n-\treply = ovs_vport_cmd_alloc_info();\n-\tif (!reply)\n-\t\treturn -ENOMEM;\n-\n \tovs_lock();\n \tvport = lookup_vport(sock_net(skb->sk), genl_info_userhdr(info), a);\n \terr = PTR_ERR(vport);\n \tif (IS_ERR(vport))\n-\t\tgoto exit_unlock_free;\n+\t\tgoto exit_unlock;\n \n \tif (a[OVS_VPORT_ATTR_TYPE] &&\n \t nla_get_u32(a[OVS_VPORT_ATTR_TYPE]) != vport->ops->type) {\n \t\terr = -EINVAL;\n-\t\tgoto exit_unlock_free;\n+\t\tgoto exit_unlock;\n \t}\n \n \tif (a[OVS_VPORT_ATTR_OPTIONS]) {\n \t\terr = ovs_vport_set_options(vport, a[OVS_VPORT_ATTR_OPTIONS]);\n \t\tif (err)\n-\t\t\tgoto exit_unlock_free;\n+\t\t\tgoto exit_unlock;\n \t}\n \n-\n \tif (a[OVS_VPORT_ATTR_UPCALL_PID]) {\n \t\tstruct nlattr *ids = a[OVS_VPORT_ATTR_UPCALL_PID];\n \n \t\terr = ovs_vport_set_upcall_portids(vport, ids);\n \t\tif (err)\n-\t\t\tgoto exit_unlock_free;\n+\t\t\tgoto exit_unlock;\n+\t}\n+\n+\treply = genlmsg_new(ovs_vport_cmd_msg_size(vport), GFP_KERNEL);\n+\tif (!reply) {\n+\t\terr = -ENOMEM;\n+\t\tgoto exit_unlock;\n \t}\n \n \terr = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),\n \t\t\t\t info->snd_portid, info->snd_seq, 0,\n \t\t\t\t OVS_VPORT_CMD_SET, GFP_KERNEL);\n-\tBUG_ON(err < 0);\n+\tif (WARN_ON_ONCE(err < 0)) {\n+\t\tkfree_skb(reply);\n+\t\tgoto exit_unlock;\n+\t}\n \n \tovs_unlock();\n \tovs_notify(&dp_vport_genl_family, reply, info);\n \treturn 0;\n \n-exit_unlock_free:\n+exit_unlock:\n \tovs_unlock();\n-\tkfree_skb(reply);\n \treturn err;\n }\n \n@@ -2433,25 +2450,30 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)\n \tunsigned int new_headroom;\n \tint err;\n \n-\treply = ovs_vport_cmd_alloc_info();\n-\tif (!reply)\n-\t\treturn -ENOMEM;\n-\n \tovs_lock();\n \tvport = lookup_vport(sock_net(skb->sk), genl_info_userhdr(info), a);\n \terr = PTR_ERR(vport);\n \tif (IS_ERR(vport))\n-\t\tgoto exit_unlock_free;\n+\t\tgoto exit_unlock;\n \n \tif (vport->port_no == OVSP_LOCAL) {\n \t\terr = -EINVAL;\n-\t\tgoto exit_unlock_free;\n+\t\tgoto exit_unlock;\n+\t}\n+\n+\treply = genlmsg_new(ovs_vport_cmd_msg_size(vport), GFP_KERNEL);\n+\tif (!reply) {\n+\t\terr = -ENOMEM;\n+\t\tgoto exit_unlock;\n \t}\n \n \terr = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),\n \t\t\t\t info->snd_portid, info->snd_seq, 0,\n \t\t\t\t OVS_VPORT_CMD_DEL, GFP_KERNEL);\n-\tBUG_ON(err < 0);\n+\tif (WARN_ON_ONCE(err < 0)) {\n+\t\tkfree_skb(reply);\n+\t\tgoto exit_unlock;\n+\t}\n \n \t/* the vport deletion may trigger dp headroom update */\n \tdp = vport->dp;\n@@ -2472,9 +2494,8 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)\n \tovs_notify(&dp_vport_genl_family, reply, info);\n \treturn 0;\n \n-exit_unlock_free:\n+exit_unlock:\n \tovs_unlock();\n-\tkfree_skb(reply);\n \treturn err;\n }\n \n@@ -2484,9 +2505,20 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)\n \tstruct ovs_header *ovs_header = genl_info_userhdr(info);\n \tstruct sk_buff *reply;\n \tstruct vport *vport;\n+\tsize_t msg_size;\n \tint err;\n \n-\treply = ovs_vport_cmd_alloc_info();\n+\trcu_read_lock();\n+\tvport = lookup_vport(sock_net(skb->sk), ovs_header, a);\n+\terr = PTR_ERR(vport);\n+\tif (IS_ERR(vport)) {\n+\t\trcu_read_unlock();\n+\t\treturn err;\n+\t}\n+\tmsg_size = ovs_vport_cmd_msg_size(vport);\n+\trcu_read_unlock();\n+\n+\treply = genlmsg_new(msg_size, GFP_KERNEL);\n \tif (!reply)\n \t\treturn -ENOMEM;\n \n@@ -2495,12 +2527,17 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)\n \terr = PTR_ERR(vport);\n \tif (IS_ERR(vport))\n \t\tgoto exit_unlock_free;\n+\n \terr = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),\n \t\t\t\t info->snd_portid, info->snd_seq, 0,\n \t\t\t\t OVS_VPORT_CMD_GET, GFP_ATOMIC);\n-\tBUG_ON(err < 0);\n \trcu_read_unlock();\n \n+\tif (err < 0) {\n+\t\tkfree_skb(reply);\n+\t\treturn err;\n+\t}\n+\n \treturn genlmsg_reply(reply, info);\n \n exit_unlock_free:\n", "prefixes": [ "ovs-dev", "net" ] }