Re: [PATCH net] net: openvswitch: fix potential UAF on meter attach failure

[Eelco Chaudron]

On 27 Jul 2026, at 14:10, Ilya Maximets wrote:

> While attaching a newly created meter attach_meter() function makes
> the new meter visible to other CPUs but can still fail afterwards.
> On failure, it detaches the meter back and returns an error.
>
> However, this is an unexpected behavior for the ovs_meter_cmd_set()
> that uses a plain kfree(meter) on attach failure without waiting for
> RCU readers to stop using it, assuming it was never visible.
>
> This is never a problem for ovs-vswitchd as it always creates meters
> before creating any flows that use them.  But the UAF can be triggered
> with a custom application using uAPI:
>
>  BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)
>  Read of size 8 at addr ffff88810d152650 by task meter/2508
>
>  Call Trace:
>   ovs_meter_execute (net/openvswitch/meter.c:653)
>   do_execute_actions (net/openvswitch/actions.c:1407)
>   ovs_execute_actions (net/openvswitch/actions.c:1584)
>   ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)
>   ...
>   netlink_sendmsg (af_netlink.c:1900)
>
>  Allocated by task 2519:
>   __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
>   ovs_meter_cmd_set (net/openvswitch/meter.c:422)
>   ...
>   netlink_sendmsg (af_netlink.c:1900)
>
>  Freed by task 2519:
>   kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
>   ovs_meter_cmd_set (net/openvswitch/meter.c:479)
>   ...
>   netlink_sendmsg (af_netlink.c:1900)
>
> Fix that by making sure attach_meter() doesn't make the meter visible
> until all the checks are done and the function can't fail anymore.
>
> This also makes sure the "hash" value is calculated after the potential
> re-sizing of the table.
>
> Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.
>
> Fixes: c7c4c44c9a95 ("net: openvswitch: expand the meters supported number")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ilya Maximets <i.maximets@xxxxxxx>

Thanks, Ilya, for looking into this. The patch looks good to me.

Reviewed-by:  Eelco Chaudron <echaudro@xxxxxxxxxx>