File openvswitch-CVE-2023-3966.patch of Package openvswitch.37499

--- openvswitch-2.13.2.orig/lib/netdev-offload-tc.c	2024-02-28 13:47:23.096346980 +0530
+++ openvswitch-2.13.2/lib/netdev-offload-tc.c	2024-03-12 14:03:31.575816674 +0530
@@ -1378,12 +1378,12 @@ test_key_and_mask(struct match *match)
     return 0;
 }
 
-static void
+static int
 flower_match_to_tun_opt(struct tc_flower *flower, const struct flow_tnl *tnl,
                         const struct flow_tnl *tnl_mask)
 {
     struct geneve_opt *opt, *opt_mask;
-    int len, cnt = 0;
+    int tot_opt_len, len, cnt = 0;
 
     memcpy(flower->key.tunnel.metadata.opts.gnv, tnl->metadata.opts.gnv,
            tnl->metadata.present.len);
@@ -1394,7 +1394,14 @@ flower_match_to_tun_opt(struct tc_flower
 
     len = flower->key.tunnel.metadata.present.len;
     while (len) {
+        if (len < sizeof *opt) {
+            return EOPNOTSUPP;
+        }
         opt = &flower->key.tunnel.metadata.opts.gnv[cnt];
+        tot_opt_len = sizeof *opt + opt->length * 4;
+        if (len < tot_opt_len) {
+            return EOPNOTSUPP;
+        }
         opt_mask = &flower->mask.tunnel.metadata.opts.gnv[cnt];
 
         opt_mask->length = opt->length;
@@ -1404,6 +1411,7 @@ flower_match_to_tun_opt(struct tc_flower
     }
 
     flower->mask.tunnel.metadata.present.len = tnl->metadata.present.len;
+    return 0;
 }
 
 static int
@@ -1466,7 +1474,11 @@ netdev_tc_flow_put(struct netdev *netdev
         flower.mask.tunnel.tos = tnl_mask->ip_tos;
         flower.mask.tunnel.ttl = tnl_mask->ip_ttl;
         flower.mask.tunnel.id = (tnl->flags & FLOW_TNL_F_KEY) ? tnl_mask->tun_id : 0;
-        flower_match_to_tun_opt(&flower, tnl, tnl_mask);
+        err = flower_match_to_tun_opt(&flower, tnl, tnl_mask);
+        if (err) {
+            VLOG_WARN_RL(&error_rl, "Unable to parse geneve options");
+            return err;
+        }
         flower.tunnel = true;
     }
     memset(&mask->tunnel, 0, sizeof mask->tunnel);
--- openvswitch-2.13.2.orig/tests/system-offloads-traffic.at	2024-02-28 13:47:23.100346980 +0530
+++ openvswitch-2.13.2/tests/system-offloads-traffic.at	2024-03-11 18:20:43.686225025 +0530
@@ -66,3 +66,36 @@ in_port(3),eth(macs),eth_type(0x0800),ip
 
 OVS_TRAFFIC_VSWITCHD_STOP
 AT_CLEANUP
+AT_SETUP([offloads - handling of geneve corrupted metadata - offloads enabled])
+OVS_CHECK_GENEVE()
+
+OVS_TRAFFIC_VSWITCHD_START(
+    [_ADD_BR([br-underlay]) -- \
+     set bridge br0 other-config:hwaddr=f2:ff:00:00:00:01 -- \
+     set bridge br-underlay other-config:hwaddr=f2:ff:00:00:00:02])
+
+AT_CHECK([ovs-vsctl set Open_vSwitch . other_config:hw-offload=true])
+
+AT_CHECK([ovs-ofctl add-flow br0 "actions=normal"])
+AT_CHECK([ovs-ofctl add-flow br-underlay "actions=normal"])
+
+ADD_NAMESPACES(at_ns0)
+
+dnl Set up underlay link from host into the namespace using veth pair.
+ADD_VETH(p0, at_ns0, br-underlay, "172.31.1.1/24", f2:ff:00:00:00:03)
+AT_CHECK([ip addr add dev br-underlay "172.31.1.100/24"])
+AT_CHECK([ip link set dev br-underlay up])
+
+dnl Set up tunnel endpoints on OVS outside the namespace and with a native
+dnl linux device inside the namespace.
+ADD_OVS_TUNNEL([geneve], [br0], [at_gnv0], [172.31.1.1], [10.1.1.100/24])
+ADD_NATIVE_TUNNEL([geneve], [ns_gnv0], [at_ns0], [172.31.1.100], [10.1.1.1/24],
+                  [vni 0], [address f2:ff:00:00:00:04])
+
+NS_CHECK_EXEC([at_ns0], [$PYTHON3 $srcdir/sendpkt.py p0 f2 ff 00 00 00 02 f2 ff 00 00 00 03 08 00 45 00 00 52 00 01 00 00 40 11 1f f7 ac 1f 01 01 ac 1f 01 64 de c1 17 c1 00 3e 59 e9 01 00 65 58 00 00 00 00 00 03 00 02 f2 ff 00 00 00 01 f2 ff 00 00 00 04 08 00 45 00 00 1c 00 01 00 00 40 01 64 7a 0a 01 01 01 0a 01 01 64 08 00 f7 ff 00 00 00 00  > /dev/null])
+
+OVS_WAIT_UNTIL([grep -q 'Invalid Geneve tunnel metadata' ovs-vswitchd.log])
+
+OVS_TRAFFIC_VSWITCHD_STOP(["/Invalid Geneve tunnel metadata on bridge br0 while processing icmp,in_port=1,vlan_tci=0x0000,dl_src=f2:ff:00:00:00:04,dl_dst=f2:ff:00:00:00:01,nw_src=10.1.1.1,nw_dst=10.1.1.100,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,icmp_type=8,icmp_code=0/d
+/Unable to parse geneve options/d"])
+AT_CLEANUP