Commit 546b68ac authored Mar 19, 2026 by Yang Yang Committed by Jakub Kicinski Mar 20, 2026

openvswitch: validate MPLS set/set_masked payload length



validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for
SET/SET_MASKED actions. In action handling, OVS expects fixed-size
MPLS key data (struct ovs_key_mpls).

Use the already normalized key_len (masked case included) and reject
non-matching MPLS action key sizes.

Reject invalid MPLS action payload lengths early.

Fixes: fbdcdd78 ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260319080228.3423307-1-n05ec@lzu.edu.cn


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 6931d21f

net/openvswitch/flow_netlink.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -2953,6 +2953,8 @@ static int validate_set(const struct nlattr *a,
		case OVS_KEY_ATTR_MPLS:
		if (!eth_p_mpls(eth_type))
		return -EINVAL;
		if (key_len != sizeof(struct ovs_key_mpls))
		return -EINVAL;
		break;

		case OVS_KEY_ATTR_SCTP: