From patchwork Wed Sep 2 09:27:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fourie Zhang X-Patchwork-Id: 2296488 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=dQoj3gJ9; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZcpH5rhHz1xy9 for ; Wed, 02 Sep 2026 19:27:51 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 1EE026086B; Wed, 2 Sep 2026 09:27:50 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id OlCriZrMS28G; Wed, 2 Sep 2026 09:27:49 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.9.56; helo=lists.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver= Authentication-Results: smtp3.osuosl.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=dQoj3gJ9 Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp3.osuosl.org (Postfix) with ESMTPS id 1FE7360716; Wed, 2 Sep 2026 09:27:49 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 03A55C0418; Wed, 2 Sep 2026 09:27:49 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id CDE22C0417 for ; Wed, 2 Sep 2026 09:27:47 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id B3F5C40852 for ; Wed, 2 Sep 2026 09:27:47 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id YXlcb38wvF2v for ; Wed, 2 Sep 2026 09:27:46 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2607:f8b0:4864:20::42a; helo=mail-pf1-x42a.google.com; envelope-from=littleddfu@gmail.com; receiver= Authentication-Results: smtp4.osuosl.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=dQoj3gJ9 Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by smtp4.osuosl.org (Postfix) with ESMTPS id 561544080D for ; Wed, 2 Sep 2026 09:27:45 +0000 (UTC) Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-85590c5aeabso725331b3a.3 for ; Wed, 02 Sep 2026 02:27:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788341265; x=1788946065; darn=openvswitch.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=YREt4HKo/yR3fmF2bs9ccnvMNqYMkkGFmZFuaSJ3xzQ=; b=dQoj3gJ99HmHruS4qffD8haGEcJ6Ov/BLS6qpdkTXO/AXi49yfGdC02EAzgLVYWQWN qDIVTteElPgsPXUYe/9daJGjm/1iFHs/g0eDFhZcs86QZrtmCv/JTOlz0tYfSobos73R coR9Uvt2/zlJXyFrpliK0s5kRqBVUuiQbKl3AyIypDfAU3CEeWnnwTwXi5zjWkCCquzH TSoW/k9M0K9J9gV6etMTt5mNx7VxWWJUG3p3guwX5NthSEZh780I0g0Xa244YQIBcn49 3Uv7VZqHoeoLMPrv5DbkmcDfm40TLHqhmGQ4YXqaW3i++9EakEjtI++ViQU+teJ9/tu1 DyfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788341265; x=1788946065; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YREt4HKo/yR3fmF2bs9ccnvMNqYMkkGFmZFuaSJ3xzQ=; b=qRVMb6cLtkGzOzr3BWI0OxEqD0iauXDAZ574Wi8o4FUj5YMtWMhSo1t2N79K5RylID tGFAPLtVdNQAqYdzXZXIzGDAi2R+L8g6ex1ADsSUNJpy7brhwu4vkx9hCdSTPhKFYiCj KpUDswnnIgUpSBkIteMrO0QUJx+WzGkHoDcjPM02OmnOXGeaJKHsm5J3Ffi95HM7mhBM M/WZKpXU4/qTN+Hcgl2YIR0RJ4ihmwhWDxO+sROfxufjlhzNz5fiK+Bs1rfTdwwulfko GZk3qIW3Hw6HV0tLadnON3oOciZb3/ZE8VoBnjW1bSkzy+rMQAiXMM+Bj8PBMwaj65v2 L8mQ== X-Forwarded-Encrypted: i=1; AKwUvBxzQF8tiwCo9RWNUDRPWEEue/H6g/ShwI2rDBsoDWfRUFMce4O+psU9e7/YvC9PuVFyPOo=@openvswitch.org X-Gm-Message-State: AFuF++kuk87tvRNk7y/AgoODVrT1UreUpc6fQ0FAOOTHbg/4tmclzYLB +UeGN8VO1K8HTBp/lfTsNbyJcqyxz7v0VaeKkr3C/DFj4Jh6DW1kn0yE X-Gm-Gg: AYBFou3DYiFxSZ9McCON8sICLIQuPxe8PqaMXL11DQfgWpiXyoxGtfRS5RW8NZGeh59 MMJa/EvtHFVJI6xLJManHRfcaKvdtgWD8ijENTpxLLJlpANkhe+BQ/3MdsYPiTbZjFrZHjadi7Q 6hEEU0G1D36DmlcVQc0ZPIMEulnrnKrOqu4rTkNi8dISm5XY7cBesgtDiz2uXR7bWd08kDMOicb PPxKBuZRzjmMMdcDFNSBdIdj9npO9bD1868oQa+p99oQKDb9utvRDDrfWMFV+rwnL+J7oOhd1mP uZ31WO9VX2XUYlcDA/P0kcpfSfof/4mRSu9eolQf0W0vlyIFn2Md2VYYggB1cLib6Xf1sTIH68G it9SgZCnNlnjliwuzCTp+I+Gb1Thbe0MejnBDEP4LvZV+WC/qm+yseQwezkSajI1FHWibKllxBa wP+J3k9JrZ3U5VRPgJZoxaTWIaUg9SrYLXuywbe163oaH9S2iTUdLHuHYzbOznU3Eqmg== X-Received: by 2002:a05:6a00:368c:b0:851:c1d2:c48d with SMTP id d2e1a72fcca58-85ed25e0713mr5793959b3a.8.1788341264937; Wed, 02 Sep 2026 02:27:44 -0700 (PDT) Received: from TENCENT64.site ([103.7.29.106]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-85dc0810a7bsm1051678b3a.47.2026.09.02.02.27.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 02:27:44 -0700 (PDT) From: Fourie Zhang X-Google-Original-From: Fourie Zhang To: netdev@vger.kernel.org, "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Date: Wed, 2 Sep 2026 17:27:12 +0800 Message-ID: <20260902092719.2874481-1-fouriezhang@tencent.com> X-Mailer: git-send-email 2.43.7 MIME-Version: 1.0 Subject: [ovs-dev] [PATCH net v2] net: mpls: clear inner_protocol when the last label is popped X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dev@openvswitch.org, TencentOS Corvus AI , Jiri Pirko , Fourie Zhang , Jiri Benc , Ilya Maximets , Jamal Hadi Salim , stable@vger.kernel.org, Simon Horman , Cong Wang Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does. Fixes: 48d2ab609b6b ("net: mpls: Fixups for GSO") Cc: stable@vger.kernel.org Assisted-by: tencentos-corvus-ai:hy4-preview Signed-off-by: Fourie Zhang Acked-by: Jiri Benc --- v2: - correct the Fixes tag (Jiri Benc) v1: https://lore.kernel.org/netdev/20260902082924.2812968-1-fouriezhang@tencent.com/ A KASAN reproducer for this issue is available if requested. net/core/skbuff.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 966af3beed94..cc3b4b70288b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6690,6 +6690,13 @@ int skb_mpls_pop(struct sk_buff *skb, __be16 next_proto, int mac_len, } skb->protocol = next_proto; + /* The last label is gone, so the inner header recorded by + * skb_mpls_push() no longer describes this packet. Drop it, or a + * later push keeps the stale offset. + */ + if (!eth_p_mpls(next_proto)) + skb->inner_protocol = 0; + return 0; } EXPORT_SYMBOL_GPL(skb_mpls_pop);