On 27 Jul 2026, at 14:10, Ilya Maximets wrote:
> While attaching a newly created meter attach_meter() function makes
> the new meter visible to other CPUs but can still fail afterwards.
> On failure, it detaches the meter back and returns an error.
>
> However, this is an unexpected behavior for the ovs_meter_cmd_set()
> that uses a plain kfree(meter) on attach failure without waiting for
> RCU readers to stop using it, assuming it was never visible.
>
> This is never a problem for ovs-vswitchd as it always creates meters
> before creating any flows that use them. But the UAF can be triggered
> with a custom application using uAPI:
>
> BUG: KASAN: slab-use-after-free in ovs_meter_execute
> (net/openvswitch/meter.c:653)
> Read of size 8 at addr ffff88810d152650 by task meter/2508
>
> Call Trace:
> ovs_meter_execute (net/openvswitch/meter.c:653)
> do_execute_actions (net/openvswitch/actions.c:1407)
> ovs_execute_actions (net/openvswitch/actions.c:1584)
> ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)
> ...
> netlink_sendmsg (af_netlink.c:1900)
>
> Allocated by task 2519:
> __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
> ovs_meter_cmd_set (net/openvswitch/meter.c:422)
> ...
> netlink_sendmsg (af_netlink.c:1900)
>
> Freed by task 2519:
> kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
> ovs_meter_cmd_set (net/openvswitch/meter.c:479)
> ...
> netlink_sendmsg (af_netlink.c:1900)
>
> Fix that by making sure attach_meter() doesn't make the meter visible
> until all the checks are done and the function can't fail anymore.
>
> This also makes sure the "hash" value is calculated after the potential
> re-sizing of the table.
>
> Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.
>
> Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number")
> Cc: [email protected]
> Signed-off-by: Ilya Maximets <[email protected]>
Thanks, Ilya, for looking into this. The patch looks good to me.
Reviewed-by: Eelco Chaudron <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
