Andrew Lukoshko
ca61dd79c6
Add the RHEL 687.11.1..687.12.1 backports (1198-1252) sourced from centos-stream-9 and upstream stable, on top of 687.10.1. Bump to 5.14.0-687.12.1.
64 lines
2.6 KiB
Diff
64 lines
2.6 KiB
Diff
From 5d5232da1baa2166824e36281792850a35621cb8 Mon Sep 17 00:00:00 2001
|
|
From: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
Date: Mon, 27 Apr 2026 10:27:43 +0000
|
|
Subject: [PATCH] net: sched: act_csum: validate nested VLAN headers
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-171139
|
|
CVE: CVE-2026-31684
|
|
|
|
commit c842743d073bdd683606cb414eb0ca84465dd834
|
|
Author: Ruide Cao <caoruide123@gmail.com>
|
|
Date: Thu Apr 2 22:46:20 2026 +0800
|
|
|
|
net: sched: act_csum: validate nested VLAN headers
|
|
|
|
tcf_csum_act() walks nested VLAN headers directly from skb->data when an
|
|
skb still carries in-payload VLAN tags. The current code reads
|
|
vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without
|
|
first ensuring that the full VLAN header is present in the linear area.
|
|
|
|
If only part of an inner VLAN header is linearized, accessing
|
|
h_vlan_encapsulated_proto reads past the linear area, and the following
|
|
skb_pull(VLAN_HLEN) may violate skb invariants.
|
|
|
|
Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and
|
|
pulling each nested VLAN header. If the header still is not fully
|
|
available, drop the packet through the existing error path.
|
|
|
|
Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets")
|
|
Reported-by: Yifan Wu <yifanwucs@gmail.com>
|
|
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
|
|
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
|
|
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
|
|
Suggested-by: Xin Liu <bird@lzu.edu.cn>
|
|
Tested-by: Ren Wei <enjou1224z@gmail.com>
|
|
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
|
|
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
|
|
Reviewed-by: Simon Horman <horms@kernel.org>
|
|
Link: https://patch.msgid.link/22df2fcb49f410203eafa5d97963dd36089f4ecf.1774892775.git.caoruide123@gmail.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
|
|
Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
|
|
|
|
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
|
|
index 5cc8e407e791..8ea37c2c3c54 100644
|
|
--- a/net/sched/act_csum.c
|
|
+++ b/net/sched/act_csum.c
|
|
@@ -603,8 +603,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb,
|
|
protocol = skb->protocol;
|
|
orig_vlan_tag_present = true;
|
|
} else {
|
|
- struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
|
|
+ struct vlan_hdr *vlan;
|
|
|
|
+ if (!pskb_may_pull(skb, VLAN_HLEN))
|
|
+ goto drop;
|
|
+
|
|
+ vlan = (struct vlan_hdr *)skb->data;
|
|
protocol = vlan->h_vlan_encapsulated_proto;
|
|
skb_pull(skb, VLAN_HLEN);
|
|
skb_reset_network_header(skb);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|