diff --git a/SOURCES/1100-net-skbuff-propagate-shared-frag-marker.patch b/SOURCES/1100-net-skbuff-propagate-shared-frag-marker.patch index b6102db5a..fdd8e9ace 100644 --- a/SOURCES/1100-net-skbuff-propagate-shared-frag-marker.patch +++ b/SOURCES/1100-net-skbuff-propagate-shared-frag-marker.patch @@ -1,22 +1,29 @@ -From: Andrew Lukoshko -Subject: [PATCH AlmaLinux 8] net: skbuff: propagate shared-frag marker through pskb_copy() +From: Eduard Abdullin +Subject: [PATCH AlmaLinux 8] net: skbuff: propagate shared-frag marker through frag-transfer helpers -Backport of upstream patch posted at -https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/ +Backport of upstream v3 patch posted at +https://lore.kernel.org/all/agW4vC0r8QOUKtRT@v4bel/ (sibling to upstream commit f4c50a4034e6 "xfrm: esp: avoid in-place decrypt on shared skb frags"). -__pskb_copy_fclone() shallow-copies the source's frag descriptors and -bumps each page's refcount via skb_frag_ref(), then defers the rest -of the shinfo metadata to skb_copy_header(). That helper only carries -over gso_{size,segs,type} and never touches skb_shinfo()->tx_flags, -so the destination skb keeps a reference to the same externally-owned -or page-cache-backed pages while reporting skb_has_shared_frag() as -false. +Three frag-transfer helpers in net/core/skbuff.c +(__pskb_copy_fclone(), skb_try_coalesce(), skb_shift()) and two +helpers in the same file on AlmaLinux 8 (skb_gro_receive() and +skb_gro_receive_list(), which upstream split out to net/core/gro.c +in v5.19) fail to propagate the SKBFL_SHARED_FRAG bit (named +SKBTX_SHARED_FRAG in 4.18) when moving frag descriptors from source +to destination. As a result, the destination skb keeps a reference +to the same externally-owned or page-cache-backed pages while +reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured -through skb_cow_data(). +through skb_cow_data(). ESP input is one such writer (esp4.c, +esp6.c). Combined with an nft 'dup to ' rule, an +nf_dup_ipv4() / xt_TEE caller, or ESP-over-UDP with UDP GRO, this +lets an unprivileged user write into the page cache of a root-owned +read-only file via authencesn-ESN stray writes (CVE-2026-46300, +"Fragnesia"). Set SKBTX_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() @@ -24,23 +31,39 @@ share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. -Tree adaptation: - * Upstream introduces skb_shinfo()->flags and SKBFL_SHARED_FRAG - (commit 06b4feb37e69, v5.16). AlmaLinux 8 (4.18 kernel) still - uses the original SKBTX_SHARED_FRAG bit in skb_shinfo()->tx_flags, - which is also what skb_has_shared_frag() consults here. Translate - the new field/macro back to the legacy ones. +The same omission exists in skb_gro_receive() and +skb_gro_receive_list(). The former moves the incoming skb's frag +descriptors into the accumulator's last sub-skb via two paths (a +direct frag-move loop and the head_frag + memcpy path) plus a +"merge:" fallback that chains the whole skb onto frag_list; the +latter chains the incoming skb whole onto p's frag_list. Downstream +skb_segment() reads only skb_shinfo(p)->tx_flags, and +skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both +p and lp must carry the marker. -Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects) -against kernel-4.18.0-553.124.1.el8_10. +Tree adaptation: + * Upstream uses skb_shinfo()->flags and SKBFL_SHARED_FRAG (commit + 06b4feb37e69, v5.16) and lives in net/core/gro.c (split off in + v5.19). AlmaLinux 8 (4.18 kernel) still keeps skb_gro_receive() + and skb_gro_receive_list() in net/core/skbuff.c and uses the + original SKBTX_SHARED_FRAG bit in skb_shinfo()->tx_flags, which + is also what skb_has_shared_frag() consults here. Translate the + new field/macro back to the legacy ones and target + net/core/skbuff.c for all five hunks. + * Upstream skb_shift() uses skb_len_add() helpers (v5.16+); AL 8 + still has the open-coded `skb->len -= shiftlen; ...` block. The + insertion point (right after both ip_summed assignments) is the + same. Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") +Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") +Reported-by: Sultan Alsawaf Reported-by: William Bowling Reported-by: Hyunwoo Kim -Signed-off-by: Andrew Lukoshko +Signed-off-by: Eduard Abdullin --- - net/core/skbuff.c | 3 +++ - 1 file changed, 3 insertions(+) + net/core/skbuff.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -52,7 +75,38 @@ Signed-off-by: Andrew Lukoshko } if (skb_has_frag_list(skb)) { -@@ -5576,6 +5577,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, +@@ -3586,6 +3587,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen) + tgt->ip_summed = CHECKSUM_PARTIAL; + skb->ip_summed = CHECKSUM_PARTIAL; + ++ skb_shinfo(tgt)->tx_flags |= skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG; ++ + /* Yak, is it really working this way? Some helper please? */ + skb->len -= shiftlen; + skb->data_len -= shiftlen; +@@ -4004,6 +4007,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) + p->truesize += skb->truesize; + p->len += skb->len; + ++ skb_shinfo(p)->tx_flags |= skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG; ++ + NAPI_GRO_CB(skb)->same_flow = 1; + + return 0; +@@ -4462,10 +4467,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) + p->data_len += len; + p->truesize += delta_truesize; + p->len += len; ++ skb_shinfo(p)->tx_flags |= skbinfo->tx_flags & SKBTX_SHARED_FRAG; + if (lp != p) { + lp->data_len += len; + lp->truesize += delta_truesize; + lp->len += len; ++ skb_shinfo(lp)->tx_flags |= skbinfo->tx_flags & SKBTX_SHARED_FRAG; + } + NAPI_GRO_CB(skb)->same_flow = 1; + return 0; +@@ -5576,6 +5583,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, from_shinfo->frags, from_shinfo->nr_frags * sizeof(skb_frag_t)); to_shinfo->nr_frags += from_shinfo->nr_frags; diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 73bbcef52..99df734b5 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -38,11 +38,11 @@ # define buildid .local %define specversion 4.18.0 -%define pkgrelease 553.124.2.el8_10 +%define pkgrelease 553.124.3.el8_10 %define tarfile_release 553.124.1.el8_10 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 553.124.2%{?dist} +%define specrelease 553.124.3%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -2716,6 +2716,9 @@ fi # # %changelog +* Thu May 14 2026 Eduard Abdullin - 4.18.0-553.124.3 +- net: skbuff: propagate shared-frag marker through frag-transfer helpers + * Wed May 13 2026 Andrew Lukoshko - 4.18.0-553.124.2 - net: skbuff: propagate shared-frag marker through pskb_copy()