net: openvswitch: Fix the dead loop of MPLS parse

JIRA: https://issues.redhat.com/browse/RHEL-95607

commit 0bdc924
Author: Faicker Mo <[email protected]>
Date:   Fri May 23 03:41:43 2025 +0000

    net: openvswitch: Fix the dead loop of MPLS parse

    The unexpected MPLS packet may not end with the bottom label stack.
    When there are many stacks, The label count value has wrapped around.
    A dead loop occurs, soft lockup/CPU stuck finally.

    stack backtrace:
    UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
    index -1 is out of range for type '__be32 [3]'
    CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G           OE   5.15.0-121-generic #131-Ubuntu
    Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021
    Call Trace:
     <IRQ>
     show_stack+0x52/0x5c
     dump_stack_lvl+0x4a/0x63
     dump_stack+0x10/0x16
     ubsan_epilogue+0x9/0x36
     __ubsan_handle_out_of_bounds.cold+0x44/0x49
     key_extract_l3l4+0x82a/0x840 [openvswitch]
     ? kfree_skbmem+0x52/0xa0
     key_extract+0x9c/0x2b0 [openvswitch]
     ovs_flow_key_extract+0x124/0x350 [openvswitch]
     ovs_vport_receive+0x61/0xd0 [openvswitch]
     ? kernel_init_free_pages.part.0+0x4a/0x70
     ? get_page_from_freelist+0x353/0x540
     netdev_port_receive+0xc4/0x180 [openvswitch]
     ? netdev_port_receive+0x180/0x180 [openvswitch]
     netdev_frame_hook+0x1f/0x40 [openvswitch]
     __netif_receive_skb_core.constprop.0+0x23a/0xf00
     __netif_receive_skb_list_core+0xfa/0x240
     netif_receive_skb_list_internal+0x18e/0x2a0
     napi_complete_done+0x7a/0x1c0
     bnxt_poll+0x155/0x1c0 [bnxt_en]
     __napi_poll+0x30/0x180
     net_rx_action+0x126/0x280
     ? bnxt_msix+0x67/0x80 [bnxt_en]
     handle_softirqs+0xda/0x2d0
     irq_exit_rcu+0x96/0xc0
     common_interrupt+0x8e/0xa0
     </IRQ>

    Fixes: fbdcdd7 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
    Signed-off-by: Faicker Mo <[email protected]>
    Acked-by: Ilya Maximets <[email protected]>
    Reviewed-by: Aaron Conole <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>

Signed-off-by: Aaron Conole <[email protected]>

Author: apconole

net/openvswitch/flow.c

@@ -648,7 +648,7 @@ static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
 			memset(&key->ipv4, 0, sizeof(key->ipv4));
 		}
 	} else if (eth_p_mpls(key->eth.type)) {
-		u8 label_count = 1;
+		size_t label_count = 1;
 
 		memset(&key->mpls, 0, sizeof(key->mpls));
 		skb_set_inner_network_header(skb, skb->mac_len);