FAILED: patch "[PATCH] openvswitch: Fix unsafe attribute parsing in" failed to apply to 5.4-stable tree

The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 6beb6835c1fbb3f676aebb51a5fee6b77fed9308
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025050913-rubble-confirm-99ee@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 6beb6835c1fbb3f676aebb51a5fee6b77fed9308 Mon Sep 17 00:00:00 2001
From: Eelco Chaudron <[email protected]>
Date: Tue, 6 May 2025 16:28:54 +0200
Subject: [PATCH] openvswitch: Fix unsafe attribute parsing in
output_userspace()

This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed.

index 61fea7baae5d..2f22ca59586f 100644
@@ -975,8 +975,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb,
 	upcall.cmd = OVS_PACKET_CMD_ACTION;
 	upcall.mru = OVS_CB(skb)->mru;
 
-	for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
-	     a = nla_next(a, &rem)) {
+	nla_for_each_nested(a, attr, rem) {
 		switch (nla_type(a)) {
 		case OVS_USERSPACE_ATTR_USERDATA:
 			upcall.userdata = a;

This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed.

---
The patch did not apply cleanly due to a previously applied style fix that corrected indentation in the original for loop. This patch has been adjusted accordingly to account for that change.

---
 net/openvswitch/actions.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 815a55fa7356..5af7fe6312cf 100644
@@ -967,8 +967,7 @@ static int output_userspace(struct datapath *dp, struct sk_buff *skb,
 	upcall.cmd = OVS_PACKET_CMD_ACTION;
 	upcall.mru = OVS_CB(skb)->mru;
 
-	for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
-		 a = nla_next(a, &rem)) {
+	nla_for_each_nested(a, attr, rem) {
 		switch (nla_type(a)) {
 		case OVS_USERSPACE_ATTR_USERDATA:
 			upcall.userdata = a;

2.47.1

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues:
⚠️ Found matching upstream commit but patch is missing proper reference to it

Found matching upstream commit: 6beb6835c1fbb3f676aebb51a5fee6b77fed9308

Status in newer kernel trees:
6.14.y | Present (different SHA1: 4d184c1b89b8) 6.12.y | Present (different SHA1: 4ae0a4524c47) 6.6.y | Present (different SHA1: 46e070d3714b) 6.1.y | Present (different SHA1: 68544f9fe709) 5.15.y | Present (different SHA1: 99deb2bf2bd1) 5.10.y | Present (different SHA1: c081a8228222)

Note: The patch differs from the upstream commit:
---
1: 6beb6835c1fbb ! 1: 88825867905fa openvswitch: Fix unsafe attribute parsing in output_userspace()
@@ Commit message

+ (cherry picked from commit 6beb6835c1fbb3f676aebb51a5fee6b77fed9308)

## net/openvswitch/actions.c ##
@@ net/openvswitch/actions.c: static int output_userspace(struct datapath *dp, struct sk_buff *skb,
@@ net/openvswitch/actions.c: static int output_userspace(struct datapath *dp, stru
upcall.mru = OVS_CB(skb)->mru;

- for (a = nla_data(attr), rem = nla_len(attr); rem > 0;
-- a = nla_next(a, &rem)) {
+- a = nla_next(a, &rem)) {
+ nla_for_each_nested(a, attr, rem) {
switch (nla_type(a)) { case OVS_USERSPACE_ATTR_USERDATA:
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.4.y        |  Success    |  Success   |

Hi Sasha,

This is my first backport, so can you let me know what the exact tag should be, as I just added the ‘cherry picked’ comment? And do you want a v2?’

Hi Greg,

I've just sent out a patch using the description below. This is my first time doing this, so please let me know if I messed anything up. :)

Cheers,

Eelco