net: openvswitch: fix leak of nested actions

[mirror_ubuntu-jammy-kernel.git] / net / openvswitch / flow.c

diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9713035b89e3ab2a20f9826621063a66c2f4c994..02096f2ec678468ae92e19538c2b30cea6d21e92 100644 (file)
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -34,6 +34,7 @@
 #include <net/mpls.h>
 #include <net/ndisc.h>
 #include <net/nsh.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 #include "conntrack.h"
 #include "datapath.h"
@@ -858,8 +859,9 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
 #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT)
        struct tc_skb_ext *tc_ext;
 #endif
-       bool post_ct = false;
+       bool post_ct = false, post_ct_snat = false, post_ct_dnat = false;
        int res, err;
+       u16 zone = 0;
 
        /* Extract metadata from packet. */
        if (tun_info) {
@@ -898,6 +900,9 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
                key->recirc_id = tc_ext ? tc_ext->chain : 0;
                OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
                post_ct = tc_ext ? tc_ext->post_ct : false;
+               post_ct_snat = post_ct ? tc_ext->post_ct_snat : false;
+               post_ct_dnat = post_ct ? tc_ext->post_ct_dnat : false;
+               zone = post_ct ? tc_ext->zone : 0;
        } else {
                key->recirc_id = 0;
        }
@@ -906,8 +911,19 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
 #endif
 
        err = key_extract(skb, key);
-       if (!err)
+       if (!err) {
                ovs_ct_fill_key(skb, key, post_ct);   /* Must be after key_extract(). */
+               if (post_ct) {
+                       if (!skb_get_nfct(skb)) {
+                               key->ct_zone = zone;
+                       } else {
+                               if (!post_ct_dnat)
+                                       key->ct_state &= ~OVS_CS_F_DST_NAT;
+                               if (!post_ct_snat)
+                                       key->ct_state &= ~OVS_CS_F_SRC_NAT;
+                       }
+               }
+       }
        return err;
 }