From: Ilya Maximets <i.maximets@ovn.org> mainline inclusion from mainline-v7.3-rc5 commit 1a4151e6be57b098b7a5ebfbde58585e83200cdc category: bugfix bugzilla: 189268 CVE: CVE-2026-98490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway. Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action") Cc: stable@vger.kernel.org Reported-by: Axel Mierczuk <axel.mierczuk@1password.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260921145655.3167436-4-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Conflicts: net/openvswitch/conntrack.c [Conflicts are caused by the following patches not being merged: 5.10 still calls the local ovs_ct_helper() wrapper while upstream uses nf_ct_helper(), and lacks verdict_to_errno(): ca71277f36e0 ("net: move the ct helper function to nf_conntrack_helper for ovs and tc") c7f79f2620b7 ("openvswitch: prepare for stolen verdict coming from conntrack and nat engine") 5.10 keeps add_helper live (its cleanup 5e6c14dd42a1 and the guard 3c1860543fcc are not merged), so the confirmed branch must keep add_helper: 5e6c14dd42a1 ("net: openvswitch: conntrack: remove 'add_helper' dead code")] Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> Signed-off-by: Yi Yang <yiyang13@huawei.com> --- net/openvswitch/conntrack.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index c59ef6264576..b6919a23ecbf 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1038,14 +1038,15 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, } } - /* Call the helper only if: - * - nf_conntrack_in() was executed above ("!cached") or a - * helper was just attached ("add_helper") for a confirmed - * connection, or - * - When committing an unconfirmed connection. + /* Call the helper only if nf_conntrack_in() was executed + * above ("!cached") or a helper was just attached ("add_helper") + * for a confirmed connection. + * + * For unconfirmed connections it will be called later during + * commit as we need to have all the other extensions allocated + * before the call. */ - if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : - info->commit) && + if (nf_ct_is_confirmed(ct) && (!cached || add_helper) && ovs_ct_helper(skb, info->family) != NF_ACCEPT) { return -EINVAL; } @@ -1253,6 +1254,13 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, &info->labels.mask); if (err) return err; + + /* Call the helpers now. We couldn't do this before as + * all the extensions must be allocated before the call. + */ + err = ovs_ct_helper(skb, info->family); + if (err != NF_ACCEPT) + return -EINVAL; } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) && labels_nonzero(&info->labels.mask)) { err = ovs_ct_set_labels(ct, key, &info->labels.value, -- 2.25.1