From 784df5f46a60fda4e92f09c23d1b4d47be785d8b Mon Sep 17 00:00:00 2001 From: Eelco Chaudron Date: Thu, 30 Oct 2025 12:26:52 +0800 Subject: [PATCH] openvswitch: Fix unsafe attribute parsing in output_userspace() stable inclusion from stable-v6.6.91 commit 0236742bd959332181c1fcc41a05b7b709180501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICBIZW CVE: CVE-2025-37998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0236742bd959332181c1fcc41a05b7b709180501 -------------------------------- commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 upstream. This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Signed-off-by: Eelco Chaudron Acked-by: Ilya Maximets Acked-by: Aaron Conole Link: https://patch.msgid.link/0bd65949df61591d9171c0dc13e42cea8941da10.1746541734.git.echaudro@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Signed-off-by: Zhang Changzhong --- net/openvswitch/actions.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index 9445ca97163b..471a4bb57b52 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -965,8 +965,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb, upcall.cmd = OVS_PACKET_CMD_ACTION; upcall.mru = OVS_CB(skb)->mru; - for (a = nla_data(attr), rem = nla_len(attr); rem > 0; - a = nla_next(a, &rem)) { + nla_for_each_nested(a, attr, rem) { switch (nla_type(a)) { case OVS_USERSPACE_ATTR_USERDATA: upcall.userdata = a; -- Gitee