Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E4B047D93B; Thu, 20 Aug 2026 16:38:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243890; cv=none; b=QAS+LWVpMBQ5K+h8tL015a+ug0tGhi6VnOWKc9VYzQor112B/KULl7NTJOja+kGzffK7nxmC4o7k5AhJw0PaXyyp7Z6/NVLEzgFdhYV9PNI02ZeEwxyyWTPASUZ7tc4w3K4BUp+QipLfUIpQsR+0r5QyS3Xq+axHtH8f+tu6udg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243890; c=relaxed/simple; bh=YFH1pRhhF609MLwIwQjWHjV+7sUzJx6dBAL6FMyPQ44=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LFVXm6fm+6jy8GWJ67ooIQgIM4dcIQBNGHk9n3LUozYA+7dNYzKYfupFwXj7aPqlF7eNEW1y+9k10sknUA2Lhjoihkop7wRQVlO9BDQSDK5CzPOc4IVFTqpHkeVICz1SBpepaAMKgUE+riN2dfU/dUXLVfZd0GJjg+N6ati2UKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uxyezN8v; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uxyezN8v" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6EC321F000E9; Thu, 20 Aug 2026 16:38:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787243889; bh=YBks7ZDTnAfxVWhRyYkbQkI+ngU6z4zyhpnRpNSiW0w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uxyezN8vWNB69oYZHRm/SYor2rYrVli6IygAhT08qAOKC3JuggC2lHdXGVofwJSGS xHUctYXKT9u03vE0Ne+2BZSKbCXai5iKMLWJZ0cG5uUys/OFFg4HNvr/9fiFmjLa3F +E7M77eAtQX/CNu/yUiI0qUSNET9Jk4hMwDehbd8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Xin Long , Simon Horman , Aaron Conole , Florian Westphal , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 252/272] openvswitch: move key and ovs_cb update out of handle_fragments Date: Thu, 20 Aug 2026 16:57:16 +0200 Message-ID: <20260820145239.183383232@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820145231.229664293@linuxfoundation.org> References: <20260820145231.229664293@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xin Long [ Upstream commit 1b83bf4489cbc47d88976291cc967a17adb8e118 ] This patch has no functional changes and just moves key and ovs_cb update out of handle_fragments, and skb_clear_hash() and skb->ignore_df change into handle_fragments(), to make it easier to move the duplicate code from handle_fragments() into nf_conntrack_ovs later. Note that it changes to pass info->family to handle_fragments() instead of key for the packet type check, as info->family is set according to key->eth.type in ovs_ct_copy_action() when creating the action. Signed-off-by: Xin Long Reviewed-by: Simon Horman Reviewed-by: Aaron Conole Acked-by: Florian Westphal Signed-off-by: Jakub Kicinski Stable-dep-of: 8a7ed561671a ("net/sched: act_ct: fix sk_buff leak when the header checks reject a packet") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- net/openvswitch/conntrack.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-) --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -494,13 +494,12 @@ static int ovs_ct_helper(struct sk_buff /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero * value if 'skb' is freed. */ -static int handle_fragments(struct net *net, struct sw_flow_key *key, - u16 zone, struct sk_buff *skb) +static int handle_fragments(struct net *net, struct sk_buff *skb, + u16 zone, u8 family, u8 *proto, u16 *mru) { - struct ovs_skb_cb ovs_cb = *OVS_CB(skb); int err; - if (key->eth.type == htons(ETH_P_IP)) { + if (family == NFPROTO_IPV4) { enum ip_defrag_users user = IP_DEFRAG_CONNTRACK_IN + zone; memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); @@ -508,9 +507,9 @@ static int handle_fragments(struct net * if (err) return err; - ovs_cb.mru = IPCB(skb)->frag_max_size; + *mru = IPCB(skb)->frag_max_size; #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) - } else if (key->eth.type == htons(ETH_P_IPV6)) { + } else if (family == NFPROTO_IPV6) { enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone; memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); @@ -521,22 +520,35 @@ static int handle_fragments(struct net * return err; } - key->ip.proto = ipv6_hdr(skb)->nexthdr; - ovs_cb.mru = IP6CB(skb)->frag_max_size; + *proto = ipv6_hdr(skb)->nexthdr; + *mru = IP6CB(skb)->frag_max_size; #endif } else { kfree_skb(skb); return -EPFNOSUPPORT; } + skb_clear_hash(skb); + skb->ignore_df = 1; + + return 0; +} + +static int ovs_ct_handle_fragments(struct net *net, struct sw_flow_key *key, + u16 zone, int family, struct sk_buff *skb) +{ + struct ovs_skb_cb ovs_cb = *OVS_CB(skb); + int err; + + err = handle_fragments(net, skb, zone, family, &key->ip.proto, &ovs_cb.mru); + if (err) + return err; + /* The key extracted from the fragment that completed this datagram * likely didn't have an L4 header, so regenerate it. */ ovs_flow_key_update_l3l4(skb, key); - key->ip.frag = OVS_FRAG_TYPE_NONE; - skb_clear_hash(skb); - skb->ignore_df = 1; *OVS_CB(skb) = ovs_cb; return 0; @@ -1311,7 +1323,8 @@ int ovs_ct_execute(struct net *net, stru return err; if (key->ip.frag != OVS_FRAG_TYPE_NONE) { - err = handle_fragments(net, key, info->zone.id, skb); + err = ovs_ct_handle_fragments(net, key, info->zone.id, + info->family, skb); if (err) return err; }