Paul Blakey 2158b384c6 openvswitch: Fix setting ipv6 fields causing hw csum failure ... commit d9b5ae5c1b upstream. Ipv6 ttl, label and tos fields are modified without first pulling/pushing the ipv6 header, which would have updated the hw csum (if available). This might cause csum validation when sending the packet to the stack, as can be seen in the trace below. Fix this by updating skb->csum if available. Trace resulted by ipv6 ttl dec and then sending packet to conntrack [actions: set(ipv6(hlimit=63)),ct(zone=99)]: [295241.900063] s_pf0vf2: hw csum failure [295241.923191] Call Trace: [295241.925728] <IRQ> [295241.927836] dump_stack+0x5c/0x80 [295241.931240] __skb_checksum_complete+0xac/0xc0 [295241.935778] nf_conntrack_tcp_packet+0x398/0xba0 [nf_conntrack] [295241.953030] nf_conntrack_in+0x498/0x5e0 [nf_conntrack] [295241.958344] __ovs_ct_lookup+0xac/0x860 [openvswitch] [295241.968532] ovs_ct_execute+0x4a7/0x7c0 [openvswitch] [295241.979167] do_execute_actions+0x54a/0xaa0 [openvswitch] [295242.001482] ovs_execute_actions+0x48/0x100 [openvswitch] [295242.006966] ovs_dp_process_packet+0x96/0x1d0 [openvswitch] [295242.012626] ovs_vport_receive+0x6c/0xc0 [openvswitch] [295242.028763] netdev_frame_hook+0xc0/0x180 [openvswitch] [295242.034074] __netif_receive_skb_core+0x2ca/0xcb0 [295242.047498] netif_receive_skb_internal+0x3e/0xc0 [295242.052291] napi_gro_receive+0xba/0xe0 [295242.056231] mlx5e_handle_rx_cqe_mpwrq_rep+0x12b/0x250 [mlx5_core] [295242.062513] mlx5e_poll_rx_cq+0xa0f/0xa30 [mlx5_core] [295242.067669] mlx5e_napi_poll+0xe1/0x6b0 [mlx5_core] [295242.077958] net_rx_action+0x149/0x3b0 [295242.086762] __do_softirq+0xd7/0x2d6 [295242.090427] irq_exit+0xf7/0x100 [295242.093748] do_IRQ+0x7f/0xd0 [295242.096806] common_interrupt+0xf/0xf [295242.100559] </IRQ> [295242.102750] RIP: 0033:0x7f9022e88cbd [295242.125246] RSP: 002b:00007f9022282b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffda [295242.132900] RAX: 0000000000000005 RBX: 0000000000000010 RCX: 0000000000000000 [295242.140120] RDX: 00007f9022282ba8 RSI: 00007f9022282a30 RDI: 00007f9014005c30 [295242.147337] RBP: 00007f9014014d60 R08: 0000000000000020 R09: 00007f90254a8340 [295242.154557] R10: 00007f9022282a28 R11: 0000000000000246 R12: 0000000000000000 [295242.161775] R13: 00007f902308c000 R14: 000000000000002b R15: 00007f9022b71f40 Fixes: 3fdbd1ce11 ("openvswitch: add ipv6 'set' action") Signed-off-by: Paul Blakey <paulb@nvidia.com> Link: https://lore.kernel.org/r/20220223163416.24096-1-paulb@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-02 11:33:55 +01:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:46:30 +01:00
9p	9p/trans_virtio: Remove sysfs file on probe failure	2021-09-26 13:37:28 +02:00
802	net/802/garp: fix memleak in garp_request_join()	2021-08-04 12:22:14 +02:00
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 13:58:58 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 12:47:02 +02:00
atm	atm: fix a memory leak of vcc->user_back	2020-10-01 13:12:42 +02:00
ax25	ax25: improve the incomplete fix to avoid UAF and NPD bugs	2022-02-23 11:57:33 +01:00
batman-adv	batman-adv: Don't always reallocate the fragmentation skb head	2021-11-26 11:40:41 +01:00
bluetooth	Bluetooth: refactor malicious adv data check	2022-02-08 18:16:23 +01:00
bpf	bpf: fix panic due to oob in bpf_prog_test_run_skb	2021-12-22 09:17:58 +01:00
bridge	netfilter: bridge: add support for pppoe filtering	2022-01-27 09:00:49 +01:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 11:45:33 +02:00
can	can: bcm: fix UAF of bcm op	2022-01-29 10:17:06 +01:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-11-05 11:07:03 +01:00
core	net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends	2022-03-02 11:33:54 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 15:48:46 +01:00
dccp	dccp: don't duplicate ccid when cloning dccp sock	2021-09-22 11:45:33 +02:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 11:12:18 +02:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-24 08:01:25 +02:00
dsa	net: dsa: Fix duplicate frames flooded by learning	2020-04-02 16:34:24 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:17:59 +01:00
hsr	hsr: use netdev_err() instead of WARN_ONCE()	2021-05-22 10:57:24 +02:00
ieee802154	net: ieee802154: Return meaningful error codes from the netlink helpers	2022-02-08 18:16:29 +01:00
ife
ipv4	gso: do not skip outer ip header in case of ipip and net_failover	2022-03-02 11:33:55 +01:00
ipv6	gso: do not skip outer ip header in case of ipip and net_failover	2022-03-02 11:33:55 +01:00
ipx
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-12-08 10:17:32 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:37:45 +02:00
key	af_key: relax availability checks for skb size calculation	2021-02-23 14:00:29 +01:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 11:45:33 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:12:08 +01:00
llc	net: llc: fix skb_over_panic	2021-08-04 12:22:17 +02:00
mac80211	mac80211: allow non-standard VHT MCS-10/11	2022-01-27 09:00:56 +01:00
mac802154	net: mac802154: Fix general protection fault	2021-04-16 11:57:52 +02:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 08:46:55 +01:00
ncsi	net/ncsi: Avoid GFP_KERNEL in response handler	2021-04-16 11:57:51 +02:00
netfilter	netfilter: nat: limit port clash resolution attempts	2022-02-08 18:16:27 +01:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-22 11:45:32 +02:00
netlink	net: netlink: af_netlink: Prevent empty skb by adding a check on len.	2021-12-22 09:17:58 +01:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 11:12:18 +02:00
nfc	nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()	2022-01-27 09:00:47 +01:00
nsh
openvswitch	openvswitch: Fix setting ipv6 fields causing hw csum failure	2022-03-02 11:33:55 +01:00
packet	af_packet: fix data-race in packet_setsockopt / packet_setsockopt	2022-02-08 18:16:27 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 13:57:37 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 15:38:15 +01:00
qrtr	net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()	2021-03-30 14:40:12 +02:00
rds	net/rds: correct socket tunable error in rds_tcp_tune()	2021-12-08 08:46:55 +01:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:11:57 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-12-08 10:17:32 +01:00
rxrpc	rxrpc: Fix handling of an unsupported token type in rxrpc_read()	2021-01-23 15:48:47 +01:00
sched	net: sched: limit TC_ACT_REPEAT loops	2022-02-23 11:57:35 +01:00
sctp	sctp: use call_rcu to free endpoint	2022-01-05 12:33:49 +01:00
smc	net/smc: Keep smc_close_final rc during active close	2021-12-08 08:46:55 +01:00
strparser
sunrpc	rpc: fix gss_svc_init cleanup on failure	2021-09-22 11:45:30 +02:00
switchdev
tipc	tipc: rate limit warning for received illegal binding update	2022-02-16 12:44:51 +01:00
tls
unix	af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress	2022-01-27 09:01:00 +01:00
vmw_vsock	vsock: remove vsock from connected table when connect is interrupted by a signal	2022-02-23 11:57:34 +01:00
wimax
wireless	cfg80211: call cfg80211_stop_ap when switch from P2P_GO type	2021-11-26 11:40:41 +01:00
x25	net/x25: Return the correct errno code	2021-06-30 08:48:47 -04:00
xfrm	xfrm: Fix error reporting in xfrm_state_construct.	2021-07-20 16:17:44 +02:00
compat.c	net: Return the correct errno code	2021-06-30 08:48:47 -04:00
Kconfig
Makefile	net: split out functions related to registering inflight socket files	2021-08-04 12:22:14 +02:00
socket.c	net: Set fput_needed iff FDPUT_FPUT is set	2020-08-21 09:48:14 +02:00
sysctl_net.c