linux-next.git/net/openvswitch, branch master

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18T17:42:41+00:00

Merge in late fixes in preparation for the net-next PR. Conflicts: drivers/dpll/dpll_core.c drivers/dpll/dpll_netlink.c 33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race") b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability") https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski

net: openvswitch: fix nf_connlabels leak in ovs_ct_init

2026-08-18T17:04:28+00:00

ovs_ct_init() acquires a connlabels reference before initializing the conntrack limit state. If ovs_ct_limit_init() fails, its error is returned directly. The pernet core does not invoke the exit callback for the operation whose initialization failed, so ovs_ct_exit() cannot drop the reference. This leaves labels_used elevated when Open vSwitch pernet registration fails for an existing network namespace. Subsequent conntrack entries in that namespace may allocate label extensions even though Open vSwitch failed to register. Drop the connlabels reference before returning a conntrack limit initialization error. ovs_ct_limit_init() already releases its partial state, and the original error remains unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Cc: stable@vger.kernel.org Signed-off-by: Ruoyu Wang Reviewed-by: Ilya Maximets Link: https://patch.msgid.link/20260815151729.3757984-1-ruoyuw560@gmail.com Signed-off-by: Jakub Kicinski

net: openvswitch: fix flow mask use-after-free on flow deletion

2026-08-18T17:00:47+00:00

The commit in the Fixes tag below made so flow->mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure and it can be accessible while in the same RCU critical section. This is done to avoid requiring ovs_mutex for the ovs_flow_free(). However, while removing the flow during processing of CMD_DEL, we do not take RCU read lock before the removal, and ovs_flow_cmd_fill_info() uses the flow->mask pointer afterwards. The RCU read lock is taken, but it's already late at that point. The comment on that line acknowledges that the lock is cosmetic and doesn't serve a real purpose. This leads to use-after-free if the RCU grace period passes between removal and the filling. It is a short race window, but it is there and can lead to a real crash in case memory allocation for the info takes a bit longer: BUG: KASAN: slab-use-after-free in __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487 Call Trace: __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930 ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 Allocated by task 9487: mask_alloc net/openvswitch/flow_table.c:967 flow_mask_insert net/openvswitch/flow_table.c:1012 ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084 ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 Freed by task 9485: rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978 rcu_do_batch kernel/rcu/tree.c:2645 rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897 handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622 ... instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info() to avoid this race. This also helps with cleaning up the forced cast and the cosmetic RCU read lock. Before the commit in the Fixes tag the order did not matter as long as the flow object itself was not freed. A wider RCU critical section could be another option, but we have a GFP_KERNEL allocation in the way. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042. Fixes: 56c19868e115 ("openvswitch: Make flow mask removal symmetric.") Cc: stable@vger.kernel.org Signed-off-by: Ilya Maximets Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260815005915.1097270-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski

Merge tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2026-08-14T19:23:12+00:00

Pablo Neira Ayuso says: ==================== Netfilter updates for net This includes an enhancement to detect ct memleaks easier via DEBUG_NET and flowtable preparation patches for IPv4 over IPV6 and vice-versa. This also includes a fix for the nft_ct custom expectation support. 1) Add DEBUG_NET_WARN_ON_ONCE to nf_ct_set() to spot ct memleaks. 2) Pass struct net_device_path_ctx to dev_fill_forward_path() to make it easier to pass more parameters to this function. From Lorenzo Bianconi. 3) Add ether_type field to net_device_path context structucture. 4) Rename tun.l3_proto field to tun.inner_proto. 5) Rename ctx.tun.proto to ctx.tun.inner_proto. 6) Store ether_type in flowtable context. 7) Move IPv4 and IPv6 xmit path to a helper function. 8) Move encapsulation header parser out of the flowtable lookup function. 9) Rework nft_ct custom expectation support to address a possible reallocation of ct extension area while expectation list also contains expectations. Move datapath to a ct helper to fix it. 10) Ensure timeout is always lowered for the non-closing RST case in the TCP connection tracking. 11) Bail out when inserting already dead expectation, this should not ever happen, hence report it via DEBUG_NET. 12) Comestic updates for improving the conntrack selftest dump and flush userspace program, from Qingshuang Fu. * tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo netfilter: nf_conntrack_expect: bail out on insert dead expectations netfilter: conntrack: always lower timeout for non-closing RST packets netfilter: nft_ct: move custom expectation support to helper netfilter: flowtable: detach layer 2 encapsulation parser from lookup netfilter: flowtable: move ipv4 and ipv6 xmit path to function netfilter: flowtable: store ethertype in flowtable context netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto netfilter: flowtable: rename tun.l3_proto to tun.inner_proto net: netfilter: add ether_type to net_device_path_ctx and use it net: pass net_device_path_ctx to dev_fill_forward_path() netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct() ==================== Link: https://patch.msgid.link/20260810194015.932627-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski

net: openvswitch: unexport ovs_vport_alloc/free

2026-08-14T01:33:35+00:00

Since removal of the legacy tunnel port types, there are no more users for these functions outside the main openvswitch module. Functions to register vport_ops are also not exported. Allocating vports without operations doesn't make a lot of sense. Highlighted by Sashiko as a follow up to the removal of the module infrastructure. Signed-off-by: Ilya Maximets Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260812122007.457136-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski

netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()

2026-08-10T11:01:37+00:00

Trigger a warning if nf_ct_set() overlaps an existing ct object leading to refcount leak. Add this warning to skb_set_nfct() whose only user is nf_ct_set() instead. Update existing nf_ct_set() callers to use nf_reset_ct() first to clean up stale pointer to conntrack object which migh trigger false positive warnings. Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-06T18:53:47+00:00

Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski

openvswitch: vport: remove infrastructure for separate modules

2026-08-06T13:09:23+00:00

Since removal of legacy tunnel vport types only the built-in ones remain. So, there is no need for the extra infrastructure for dynamic module loading. Can be reinstated in the future if we need a new vport type. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type. At this time we're not aware of anyone doing that. People running out-of-tree modules normally just have an out-of-tree openvswitch module as a whole. And there are actually no supported out-of-tree implementations of the openvswitch module known to the community. Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20260804182049.2289754-4-i.maximets@ovn.org Signed-off-by: Paolo Abeni

openvswitch: vport: remove infrastructure for vport options

2026-08-06T13:09:23+00:00

Since removal of tunnel vport types, there aren't any vports that support options. Let's remove the options-related infrastructure. Can be reinstated if we ever need a new vport type or if we need extra options for the existing ones. The uAPI attribute remains. Clarification comment is added to highlight that none of the supported vports support options at the moment. If the options are provided, the code now directly replies with -EOPNOTSUPP to keep the behavior the same for remaining vport types. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type and they have options for this vport type. However, our message size calculations do not account for whatever options such a port would have and so it is dangerous to load such a module without modifying the code in the main datapath.c, unless the options are smaller than the ones we had for vxlan. A more robust solution would be to have a different version of the entire openvswitch module instead, so the use case of a separate vport-type-N loaded with the upstream openvswitch module is unlikely. At this time we're not aware of anyone doing that. Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20260804182049.2289754-3-i.maximets@ovn.org Signed-off-by: Paolo Abeni

openvswitch: remove support for legacy tunnel types

2026-08-06T13:09:23+00:00

ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni