Andrew Lukoshko
5c58271075
Drop the 687.5.3/687.5.4 security-ahead patches superseded by the RHEL 687.6.1..687.10.1 backports (1100-1104), and add those backports (1100-1196) sourced from centos-stream-9 and upstream stable. Keep the AlmaLinux-ahead smb cifs.spnego fix (retained as 1197). Bump to 5.14.0-687.10.1.
40 lines
1.4 KiB
Diff
40 lines
1.4 KiB
Diff
From 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 Mon Sep 17 00:00:00 2001
|
|
From: Eric Dumazet <edumazet@google.com>
|
|
Date: Wed, 28 Jan 2026 14:15:38 +0000
|
|
Subject: [PATCH] net: add skb_header_pointer_careful() helper
|
|
|
|
This variant of skb_header_pointer() should be used in contexts
|
|
where @offset argument is user-controlled and could be negative.
|
|
|
|
Negative offsets are supported, as long as the zone starts
|
|
between skb->head and skb->data.
|
|
|
|
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
|
Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
|
|
|
|
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
|
|
index 3f4decc..574edae 100644
|
|
--- a/include/linux/skbuff.h
|
|
+++ b/include/linux/skbuff.h
|
|
@@ -4043,6 +4043,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer)
|
|
skb_headlen(skb), buffer);
|
|
}
|
|
|
|
+/* Variant of skb_header_pointer() where @offset is user-controlled
|
|
+ * and potentially negative.
|
|
+ */
|
|
+static inline void * __must_check
|
|
+skb_header_pointer_careful(const struct sk_buff *skb, int offset,
|
|
+ int len, void *buffer)
|
|
+{
|
|
+ if (unlikely(offset < 0 && -offset > skb_headroom(skb)))
|
|
+ return NULL;
|
|
+ return skb_header_pointer(skb, offset, len, buffer);
|
|
+}
|
|
+
|
|
/**
|
|
* skb_needs_linearize - check if we need to linearize a given skb
|
|
* depending on the given device features.
|