Re: [PATCH net v5] net/openvswitch: check Ethernet header length in key_extract()

patchwork-bot+netdevbpf--- via dev <[email protected]> Tue, 04 Aug 2026 11:10:06 +0000

Newsgroups	gmane.network.openvswitch.devel,gmane.linux.network,gmane.linux.kernel
Message-ID	<178584180615.3101099.8416627312797177820.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <[email protected]>:

On Thu, 30 Jul 2026 18:20:06 -0400 you wrote:
> When a packet arrives on an ARPHRD_NONE device (e.g. TUN),
> ovs_flow_key_extract() trusts the user-provided skb->protocol field: if
> it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and
> key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes
> of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes
> for MAC addresses and parse_ethertype() pulls 2 more, either of which
> triggers a kernel BUG in __skb_pull() when the linear area is too small.
> 
> [...]

Here is the summary with links:
  - [net,v5] net/openvswitch: check Ethernet header length in key_extract()
    https://git.kernel.org/netdev/net/c/cf6f8b29befb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html