9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
69 lines
2.9 KiB
Diff
69 lines
2.9 KiB
Diff
From 35ea4ea680d6794f01d54eec2b1e507a45f422cf Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Tue, 26 May 2026 13:22:20 +0200
|
|
Subject: [PATCH] netfilter: synproxy: refresh tcphdr after skb_ensure_writable
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 92170e6afe92
|
|
|
|
commit 92170e6afe927ab2792a3f71902845789c8e31b1
|
|
Author: Chris Mason <clm@meta.com>
|
|
Date: Tue May 19 12:36:14 2026 -0700
|
|
|
|
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
|
|
|
|
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
|
|
and then patches the TCP checksum via inet_proto_csum_replace4() on
|
|
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
|
|
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
|
|
before calling in, so it may either alias skb->head directly or
|
|
point at the caller's on-stack _tcph buffer.
|
|
|
|
Between obtaining the pointer and using it, the function calls
|
|
skb_ensure_writable(skb, optend), which on a cloned or non-linear
|
|
skb invokes pskb_expand_head() and frees the old skb->head. After
|
|
that point the cached th is stale:
|
|
|
|
caller (ipv[46]_synproxy_hook)
|
|
th = skb_header_pointer(skb, ..., &_tcph)
|
|
synproxy_tstamp_adjust(skb, protoff, th, ...)
|
|
skb_ensure_writable(skb, optend)
|
|
pskb_expand_head() /* kfree(old skb->head) */
|
|
...
|
|
inet_proto_csum_replace4(&th->check, ...)
|
|
/* writes into freed head, or
|
|
into the caller's stack copy
|
|
leaving the on-wire checksum
|
|
stale */
|
|
|
|
The option bytes are written through skb->data and are fine; only
|
|
the checksum update goes through th and so lands in the wrong
|
|
place. The result is either a write into freed slab memory or a
|
|
packet leaving with a checksum that does not match its payload.
|
|
|
|
Fix by re-deriving th from skb->data + protoff immediately after
|
|
skb_ensure_writable() succeeds, so the subsequent checksum update
|
|
targets the linear, writable header.
|
|
|
|
Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
|
|
Assisted-by: kres (claude-opus-4-7)
|
|
Signed-off-by: Chris Mason <clm@meta.com>
|
|
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
|
|
index 3fa3f5d..6a851ac 100644
|
|
--- a/net/netfilter/nf_synproxy_core.c
|
|
+++ b/net/netfilter/nf_synproxy_core.c
|
|
@@ -199,6 +199,8 @@ synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff,
|
|
if (skb_ensure_writable(skb, optend))
|
|
return 0;
|
|
|
|
+ th = (struct tcphdr *)(skb->data + protoff);
|
|
+
|
|
while (optoff < optend) {
|
|
unsigned char *op = skb->data + optoff;
|
|
|