Bump version to 4.18.0-553.124.3
net: skbuff: propagate shared-frag marker through frag-transfer helpers Replace 553.124.2's partial fix (which was a backport of Hyunwoo Kim's v1 patch covering only __pskb_copy_fclone() and skb_try_coalesce()) with a backport of the upstream v3 patch: https://lore.kernel.org/all/agW4vC0r8QOUKtRT@v4bel/ v3 also covers skb_shift() (the new hunk added in v2) and skb_gro_receive() / skb_gro_receive_list() (the audit follow-up suggested by Sultan Alsawaf in agVpIsaSherjHTYg@sultan-box). All five sites moved frag descriptors between skbs without propagating the SKBFL_SHARED_FRAG marker (SKBTX_SHARED_FRAG on 4.18), so destinations could end up referencing externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. Combined with ESP-over-UDP and UDP GRO, or any nf_dup_ipv4 / xt_TEE caller, this lets an unprivileged user trigger in-place ESP decryption over root-owned page-cache pages (CVE-2026-46300, "Fragnesia"). Tree-adapted to the 4.18 kernel: SKBFL_SHARED_FRAG / shinfo->flags back to the legacy SKBTX_SHARED_FRAG / shinfo->tx_flags, and skb_gro_receive() / skb_gro_receive_list() targeting net/core/skbuff.c since the net/core/gro.c split (upstream v5.19) is not in 4.18.
This commit is contained in:
eabdullin
parent
9497fbc226
commit
e1dbabe6cc
@ -1,22 +1,29 @@
|
||||
From: Andrew Lukoshko <alukoshko@almalinux.org>
|
||||
Subject: [PATCH AlmaLinux 8] net: skbuff: propagate shared-frag marker through pskb_copy()
|
||||
From: Eduard Abdullin <eabdullin@almalinux.org>
|
||||
Subject: [PATCH AlmaLinux 8] net: skbuff: propagate shared-frag marker through frag-transfer helpers
|
||||
|
||||
Backport of upstream patch posted at
|
||||
https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
|
||||
Backport of upstream v3 patch posted at
|
||||
https://lore.kernel.org/all/agW4vC0r8QOUKtRT@v4bel/
|
||||
(sibling to upstream commit f4c50a4034e6 "xfrm: esp: avoid in-place
|
||||
decrypt on shared skb frags").
|
||||
|
||||
__pskb_copy_fclone() shallow-copies the source's frag descriptors and
|
||||
bumps each page's refcount via skb_frag_ref(), then defers the rest
|
||||
of the shinfo metadata to skb_copy_header(). That helper only carries
|
||||
over gso_{size,segs,type} and never touches skb_shinfo()->tx_flags,
|
||||
so the destination skb keeps a reference to the same externally-owned
|
||||
or page-cache-backed pages while reporting skb_has_shared_frag() as
|
||||
false.
|
||||
Three frag-transfer helpers in net/core/skbuff.c
|
||||
(__pskb_copy_fclone(), skb_try_coalesce(), skb_shift()) and two
|
||||
helpers in the same file on AlmaLinux 8 (skb_gro_receive() and
|
||||
skb_gro_receive_list(), which upstream split out to net/core/gro.c
|
||||
in v5.19) fail to propagate the SKBFL_SHARED_FRAG bit (named
|
||||
SKBTX_SHARED_FRAG in 4.18) when moving frag descriptors from source
|
||||
to destination. As a result, the destination skb keeps a reference
|
||||
to the same externally-owned or page-cache-backed pages while
|
||||
reporting skb_has_shared_frag() as false.
|
||||
|
||||
The mismatch is harmful in any in-place writer that uses
|
||||
skb_has_shared_frag() to decide whether shared pages must be detoured
|
||||
through skb_cow_data().
|
||||
through skb_cow_data(). ESP input is one such writer (esp4.c,
|
||||
esp6.c). Combined with an nft 'dup to <local>' rule, an
|
||||
nf_dup_ipv4() / xt_TEE caller, or ESP-over-UDP with UDP GRO, this
|
||||
lets an unprivileged user write into the page cache of a root-owned
|
||||
read-only file via authencesn-ESN stray writes (CVE-2026-46300,
|
||||
"Fragnesia").
|
||||
|
||||
Set SKBTX_SHARED_FRAG on the destination whenever frag descriptors
|
||||
were actually moved from the source. skb_copy() and skb_copy_expand()
|
||||
@ -24,23 +31,39 @@ share skb_copy_header() too but linearize all paged data into freshly
|
||||
allocated head storage and emerge with nr_frags == 0, so
|
||||
skb_has_shared_frag() returns false on its own; they need no change.
|
||||
|
||||
Tree adaptation:
|
||||
* Upstream introduces skb_shinfo()->flags and SKBFL_SHARED_FRAG
|
||||
(commit 06b4feb37e69, v5.16). AlmaLinux 8 (4.18 kernel) still
|
||||
uses the original SKBTX_SHARED_FRAG bit in skb_shinfo()->tx_flags,
|
||||
which is also what skb_has_shared_frag() consults here. Translate
|
||||
the new field/macro back to the legacy ones.
|
||||
The same omission exists in skb_gro_receive() and
|
||||
skb_gro_receive_list(). The former moves the incoming skb's frag
|
||||
descriptors into the accumulator's last sub-skb via two paths (a
|
||||
direct frag-move loop and the head_frag + memcpy path) plus a
|
||||
"merge:" fallback that chains the whole skb onto frag_list; the
|
||||
latter chains the incoming skb whole onto p's frag_list. Downstream
|
||||
skb_segment() reads only skb_shinfo(p)->tx_flags, and
|
||||
skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both
|
||||
p and lp must carry the marker.
|
||||
|
||||
Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects)
|
||||
against kernel-4.18.0-553.124.1.el8_10.
|
||||
Tree adaptation:
|
||||
* Upstream uses skb_shinfo()->flags and SKBFL_SHARED_FRAG (commit
|
||||
06b4feb37e69, v5.16) and lives in net/core/gro.c (split off in
|
||||
v5.19). AlmaLinux 8 (4.18 kernel) still keeps skb_gro_receive()
|
||||
and skb_gro_receive_list() in net/core/skbuff.c and uses the
|
||||
original SKBTX_SHARED_FRAG bit in skb_shinfo()->tx_flags, which
|
||||
is also what skb_has_shared_frag() consults here. Translate the
|
||||
new field/macro back to the legacy ones and target
|
||||
net/core/skbuff.c for all five hunks.
|
||||
* Upstream skb_shift() uses skb_len_add() helpers (v5.16+); AL 8
|
||||
still has the open-coded `skb->len -= shiftlen; ...` block. The
|
||||
insertion point (right after both ip_summed assignments) is the
|
||||
same.
|
||||
|
||||
Fixes: cef401de7be8 ("net: fix possible wrong checksum generation")
|
||||
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
|
||||
Reported-by: Sultan Alsawaf <sultan@kerneltoast.com>
|
||||
Reported-by: William Bowling <vakzz@zellic.io>
|
||||
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
|
||||
Signed-off-by: Andrew Lukoshko <alukoshko@almalinux.org>
|
||||
Signed-off-by: Eduard Abdullin <eabdullin@almalinux.org>
|
||||
---
|
||||
net/core/skbuff.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
net/core/skbuff.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
--- a/net/core/skbuff.c
|
||||
+++ b/net/core/skbuff.c
|
||||
@ -52,7 +75,38 @@ Signed-off-by: Andrew Lukoshko <alukoshko@almalinux.org>
|
||||
}
|
||||
|
||||
if (skb_has_frag_list(skb)) {
|
||||
@@ -5576,6 +5577,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
|
||||
@@ -3586,6 +3587,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
|
||||
tgt->ip_summed = CHECKSUM_PARTIAL;
|
||||
skb->ip_summed = CHECKSUM_PARTIAL;
|
||||
|
||||
+ skb_shinfo(tgt)->tx_flags |= skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
|
||||
+
|
||||
/* Yak, is it really working this way? Some helper please? */
|
||||
skb->len -= shiftlen;
|
||||
skb->data_len -= shiftlen;
|
||||
@@ -4004,6 +4007,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
|
||||
p->truesize += skb->truesize;
|
||||
p->len += skb->len;
|
||||
|
||||
+ skb_shinfo(p)->tx_flags |= skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
|
||||
+
|
||||
NAPI_GRO_CB(skb)->same_flow = 1;
|
||||
|
||||
return 0;
|
||||
@@ -4462,10 +4467,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
|
||||
p->data_len += len;
|
||||
p->truesize += delta_truesize;
|
||||
p->len += len;
|
||||
+ skb_shinfo(p)->tx_flags |= skbinfo->tx_flags & SKBTX_SHARED_FRAG;
|
||||
if (lp != p) {
|
||||
lp->data_len += len;
|
||||
lp->truesize += delta_truesize;
|
||||
lp->len += len;
|
||||
+ skb_shinfo(lp)->tx_flags |= skbinfo->tx_flags & SKBTX_SHARED_FRAG;
|
||||
}
|
||||
NAPI_GRO_CB(skb)->same_flow = 1;
|
||||
return 0;
|
||||
@@ -5576,6 +5583,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
|
||||
from_shinfo->frags,
|
||||
from_shinfo->nr_frags * sizeof(skb_frag_t));
|
||||
to_shinfo->nr_frags += from_shinfo->nr_frags;
|
||||
|
||||
@ -38,11 +38,11 @@
|
||||
# define buildid .local
|
||||
|
||||
%define specversion 4.18.0
|
||||
%define pkgrelease 553.124.2.el8_10
|
||||
%define pkgrelease 553.124.3.el8_10
|
||||
%define tarfile_release 553.124.1.el8_10
|
||||
|
||||
# allow pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 553.124.2%{?dist}
|
||||
%define specrelease 553.124.3%{?dist}
|
||||
|
||||
%define pkg_release %{specrelease}%{?buildid}
|
||||
|
||||
@ -2716,6 +2716,9 @@ fi
|
||||
#
|
||||
#
|
||||
%changelog
|
||||
* Thu May 14 2026 Eduard Abdullin <eabdullin@almalinux.org> - 4.18.0-553.124.3
|
||||
- net: skbuff: propagate shared-frag marker through frag-transfer helpers
|
||||
|
||||
* Wed May 13 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.18.0-553.124.2
|
||||
- net: skbuff: propagate shared-frag marker through pskb_copy()
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user