From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 705B1369D67 for ; Mon, 27 Jul 2026 14:28:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785162537; cv=none; b=rcpIooUOF24obv3aepkoXdnS6Nzwe2cYIgcP9hgE4HMQaBFNPYv5OI4L+s0uFwqp1TdoWDsi14TCjjdUz7kZfLyTr7FSRKPrUdh3PGhdTuewpvITy8HAxpUNDe+O3TysoNyO4bZ6NfW4iNxP0kKZP+DTSksA7/xpNEYAU61V4Ts= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785162537; c=relaxed/simple; bh=1F2E0F8oWdzcK8owdnuCkCeBAUkTA6kxmehpUYOfQYI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qahn2dG2hN7Naia0fLwIPFyk+N05kJ8xlin3qXnUT+/wweAKSzJ1KiQE/Sv4Y80AWCy1uRjvXbZm5R3twYq4BKJhEOeLeBXbPjmPNzIRuz2062i6nsME7K5bfUAgYcijvMJU/UvSrTqY5gYVG8TeQFzucCdg9rV1vwZvakm6kw4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NXExXqzg; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=LcVPLYe5; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NXExXqzg"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="LcVPLYe5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785162532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=CgFmd6qXGD/1u/B/qklK0gxra4znkvRNbgLq4PG6yjo=; b=NXExXqzgeJaOYLHiWTfQhs6Xs9dOEBj71UpbyAPV6qlZvLqicDEXD3bdRBRARMzKjGnHYj oIfq+UeRuMtvU0xzTIGY+zAmQa0Zaf4jH3auHjg+UKwZlFkdUvVClJtVucuS27Q7utUJit KxB3ACZSyBcWHKID/Enr4T6Dkpn9nG4= Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-62-R_-zxUH9OG-O-4-8JGgudw-1; Mon, 27 Jul 2026 10:28:51 -0400 X-MC-Unique: R_-zxUH9OG-O-4-8JGgudw-1 X-Mimecast-MFC-AGG-ID: R_-zxUH9OG-O-4-8JGgudw_1785162530 Received: by mail-ed1-f70.google.com with SMTP id 4fb4d7f45d1cf-69c0f3a15dcso3046262a12.0 for ; Mon, 27 Jul 2026 07:28:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785162530; x=1785767330; darn=vger.kernel.org; h=content-type:mime-version:references:in-reply-to:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=CgFmd6qXGD/1u/B/qklK0gxra4znkvRNbgLq4PG6yjo=; b=LcVPLYe5T4gZ+qM03YZPW3uwZu4kay6mOYFhf9mDuUSAwieHUI1vfD6xs97UtxVexB Phtmrt7nltPi14CWKepGdX5YDZPdUWGgMxZleTR1j8hOjnLBf4KTeCG4uhTuFwccSvJj EM0GSIoFG5dyOmMPLaw+Zx7tU+rfHrJnLUgZ9spG43uKCq2mA1zjIU+JlNaSBc4nybdT 6yRY2MS4XrzqJ/3IXPQTGd5Jn4RqWjQ4FH2p32lmXNd2Tj6KhEerK41dTTb7Z1k56SUx nAjpypPTejebcaFnyqitJbNi8rLx65WOMoa401bcUZLmdc8tosIcEcMe9lDYA7gyQz3i kciQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785162530; x=1785767330; h=content-type:mime-version:references:in-reply-to:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=CgFmd6qXGD/1u/B/qklK0gxra4znkvRNbgLq4PG6yjo=; b=HfNVYaAeWpVvkz7Dswn1b8SYrcqhYHRDFAUiUjUN77ClSLjjf7YO7AmblQysyPkR5U YWJyfvRN9V2Usv42huIXMpwJjpLlwUQ60qBodfCs3VurKBwFTs3t4snObaSM7v/lb8/+ tW84t5K7F58UQJokIlBRSYGnGk8q87aVcpnJjWbGkALLYooxC6X+SH5XDKcKf3mh8jK4 jiyVYXHdkJ+fI3J9h6spFqbgw8V93kQsGgarzJhJ0PxEGKdBqSEkoHDut1lk9tbSnFH6 Y/qviILQW5yg6xaSIB5Ts2aMHAn2UkKaI+NsDzFkQHhOo92xEzp7CQovl5ekthB11oKh R2+g== X-Forwarded-Encrypted: i=1; AHgh+RoTNByWLMYEcdHUmyU09mn3UPkEuvWTivx4E7eMsG0VMbIMpn9rZVwiThrHOCtCPHk5CxUvAQmSPCgHJrI=@vger.kernel.org X-Gm-Message-State: AOJu0YxldHInPjIdx9kLprkGqFvJjFC1w31HrL0aYiAMWYG+ZiHV40TB ZKIqUdut7RIegc++YNeANSqrbVbOxWCA3Jv/rYZulbMhmjfrn3vlB2NuXIYCUMDQ9kDl4axMCes SG+kiHhDLNceT6o9sV3Rn+2R9u5KkCcr9uGHDThOo5uL1/xiRtAl+Xqawmb8kprChHA== X-Gm-Gg: AR+sD12UeikFSuf6XBKDoskZ3oeCSnYrWn1uggNovMQfR0gTbvPGfJdE1HaSEOq9nPm la2uK/DjIHMTTTIbJgKH439hKgDIyYaYQb0lCa9dGA3LUYlhyjUr12BquFtbSoDZ7EVi1LIDywT 1CqivxdHOQOUVafuqxp82xsiyXqahw9IYvh1HpPHjNRoBO34qFgbzkArbF7aWxLYBezU7HcjW3c dd1xlzGkg5doHGLswoF6um8WF27Msnl0TpNV5panlm2r0zlX7kmlp9Kf5PQAXmmNXxVcIVOMwue 49ZZMiUM1NzM0Ula9D/N1IMdP1nXUfy+ythip0F56jWwiD7X9EDI23TGkN49cg4ae5x7d2YpFgv 0DzldTNe2JNYtaL05oUDiYylAieC2SXcvZW6hI5HK7QztfBd5Ow== X-Received: by 2002:a05:6402:358b:b0:698:9450:92b0 with SMTP id 4fb4d7f45d1cf-69fc1007196mr3646740a12.1.1785162530107; Mon, 27 Jul 2026 07:28:50 -0700 (PDT) X-Received: by 2002:a05:6402:358b:b0:698:9450:92b0 with SMTP id 4fb4d7f45d1cf-69fc1007196mr3646728a12.1.1785162529675; Mon, 27 Jul 2026 07:28:49 -0700 (PDT) Received: from [10.44.33.167] (5920ab7b.static.cust.trined.nl. [89.32.171.123]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69fb50bd183sm2838839a12.4.2026.07.27.07.28.47 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Jul 2026 07:28:48 -0700 (PDT) From: Eelco Chaudron To: Ilya Maximets Cc: netdev@vger.kernel.org, "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , Tonghao Zhang , Aaron Conole , dev@openvswitch.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH net] net: openvswitch: fix potential UAF on meter attach failure Date: Mon, 27 Jul 2026 16:28:46 +0200 X-Mailer: MailMate (2.0r6292) Message-ID: <5EB5E9EA-2E4F-4226-993A-142C79A6DF00@redhat.com> In-Reply-To: <20260727121022.198461-1-i.maximets@ovn.org> References: <20260727121022.198461-1-i.maximets@ovn.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On 27 Jul 2026, at 14:10, Ilya Maximets wrote: > While attaching a newly created meter attach_meter() function makes > the new meter visible to other CPUs but can still fail afterwards. > On failure, it detaches the meter back and returns an error. > > However, this is an unexpected behavior for the ovs_meter_cmd_set() > that uses a plain kfree(meter) on attach failure without waiting for > RCU readers to stop using it, assuming it was never visible. > > This is never a problem for ovs-vswitchd as it always creates meters > before creating any flows that use them. But the UAF can be triggered > with a custom application using uAPI: > > BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653) > Read of size 8 at addr ffff88810d152650 by task meter/2508 > > Call Trace: > ovs_meter_execute (net/openvswitch/meter.c:653) > do_execute_actions (net/openvswitch/actions.c:1407) > ovs_execute_actions (net/openvswitch/actions.c:1584) > ovs_packet_cmd_execute (net/openvswitch/datapath.c:703) > ... > netlink_sendmsg (af_netlink.c:1900) > > Allocated by task 2519: > __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) > ovs_meter_cmd_set (net/openvswitch/meter.c:422) > ... > netlink_sendmsg (af_netlink.c:1900) > > Freed by task 2519: > kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) > ovs_meter_cmd_set (net/openvswitch/meter.c:479) > ... > netlink_sendmsg (af_netlink.c:1900) > > Fix that by making sure attach_meter() doesn't make the meter visible > until all the checks are done and the function can't fail anymore. > > This also makes sure the "hash" value is calculated after the potential > re-sizing of the table. > > Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642. > > Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number") > Cc: stable@vger.kernel.org > Signed-off-by: Ilya Maximets Thanks, Ilya, for looking into this. The patch looks good to me. Reviewed-by: Eelco Chaudron