linux-stable/net/openvswitch
Aaron Conole 6e2f90d31f net: openvswitch: limit the number of recursions from action sets
The ovs module allows for some actions to recursively contain an action
list for complex scenarios, such as sampling, checking lengths, etc.
When these actions are copied into the internal flow table, they are
evaluated to validate that such actions make sense, and these calls
happen recursively.

The ovs-vswitchd userspace won't emit more than 16 recursion levels
deep.  However, the module has no such limit and will happily accept
limits larger than 16 levels nested.  Prevent this by tracking the
number of recursions happening and manually limiting it to 16 levels
nested.

The initial implementation of the sample action would track this depth
and prevent more than 3 levels of recursion, but this was removed to
support the clone use case, rather than limited at the current userspace
limit.

Fixes: 798c166173 ("openvswitch: Optimize sample action for the clone use cases")
Signed-off-by: Aaron Conole <aconole@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240207132416.1488485-2-aconole@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-02-09 12:54:38 -08:00
..
actions.c openvswitch: reduce stack usage in do_execute_actions 2023-10-01 19:07:22 +01:00
conntrack.c net/sched: act_ct: Always fill offloading tuple iifidx 2023-11-08 17:47:08 -08:00
conntrack.h
datapath.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-18 12:44:56 -07:00
datapath.h
dp_notify.c
drop.h net: openvswitch: add misc error drop reasons 2023-08-14 08:01:06 +01:00
flow.c net/sched: cls_api: Support hardware miss to tc action 2023-02-20 16:46:10 -08:00
flow.h net: openvswitch: reduce cpu_used_mask memory 2023-02-06 22:36:29 -08:00
flow_netlink.c net: openvswitch: limit the number of recursions from action sets 2024-02-09 12:54:38 -08:00
flow_netlink.h
flow_table.c net: openvswitch: Use struct_size() 2023-10-17 13:56:03 +02:00
flow_table.h net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-17 13:56:03 +02:00
Kconfig net: create nf_conntrack_ovs for ovs and tc use 2023-02-10 16:23:03 -08:00
Makefile
meter.c genetlink: remove userhdr from struct genl_info 2023-08-15 14:54:44 -07:00
meter.h net: openvswitch: Annotate struct dp_meter with __counted_by 2023-10-02 11:24:55 -07:00
openvswitch_trace.c
openvswitch_trace.h
vport-geneve.c rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link 2022-10-31 18:10:21 -07:00
vport-gre.c rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link 2022-10-31 18:10:21 -07:00
vport-internal_dev.c openvswitch: Change the return type for vport_ops.send function hook to int 2022-09-19 18:28:50 -07:00
vport-internal_dev.h
vport-netdev.c rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link 2022-10-31 18:10:21 -07:00
vport-netdev.h
vport-vxlan.c rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link 2022-10-31 18:10:21 -07:00
vport.c net: openvswitch: fix upcall counter access before allocation 2023-06-07 12:25:05 +01:00
vport.h net: openvswitch: Add support to count upcall packets 2022-12-09 10:43:46 +00:00