On 8/3/26 2:29 AM, Zhiling Zou wrote:
> ovs_flow_cmd_new() preallocates the optional reply skb before it takes
> ovs_mutex and before it knows which existing flow will be updated.
>
> That is normally fine because the skb is sized from the request flow
> identifier. That identifier also becomes the inserted flow's identifier.
> For updates, however, a request with a UFID may miss the UFID lookup and
> then fall back to the flow key lookup. That lookup can legitimately find
> an existing key-identified flow. UFIDs are optional and the flow key is
> the primary identifier.
>
> For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow's
> identifier, not the request identifier used for the preallocation. A short
> request UFID can therefore leave too little room for the key identifier.
> The fill can then fail with -EMSGSIZE and hit the BUG_ON(error < 0) in the
> update path.
>
> Once the update target has been resolved, reallocate the reply skb if the
> matched flow needs a larger reply than the request identifier allowed. Do
> this before replacing the actions so the request can still fail cleanly if
> the rare extra allocation fails.
>
> Fixes: 74ed7ab9264c ("openvswitch: Add support for unique flow IDs.")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Signed-off-by: Zhiling Zou <[email protected]>
> ---
> changes in v5:
> - Rename current and desired to cur and req to avoid the kernel current macro.
> - Split the ovs_flow_cmd_alloc_info() call so no added line exceeds 80
> columns.
> - v4 Link:
> https://lore.kernel.org/all/3b76cbe50252a5650c3b69c789ed36481d0bbee4.1785583308.git.zhil...@nebusec.ai/
Reviewed-by: Ilya Maximets <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
