Andrew Lukoshko
018222497a
Add the RHEL 687.14.1..687.15.1 backports (1270-1284) from centos-stream-9 and
upstream stable, on top of 687.13.1. The dpll/zl3073x and ice RSS-queue series are
consolidated (they carry RHEL kABI wrapping and RHEL-only files). The mlx5 kabi
removal (RHEL-181822) is applied via updated Module.kabi_{aarch64,s390x,x86_64}.
Bump pkgrelease and specrelease to 687.15.1.
38 lines
1.5 KiB
Diff
38 lines
1.5 KiB
Diff
Subject: [PATCH] ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
|
|
# AlmaLinux: reconstructed (687.13.1->687.15.1); includes RHEL kABI / RHEL-only files
|
|
|
|
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
|
|
index 400ca6a..4475aa3 100644
|
|
--- a/net/ipv6/exthdrs.c
|
|
+++ b/net/ipv6/exthdrs.c
|
|
@@ -479,6 +479,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
|
|
struct net *net = dev_net(skb->dev);
|
|
struct inet6_dev *idev;
|
|
struct ipv6hdr *oldhdr;
|
|
+ unsigned int chdr_len;
|
|
struct in6_addr addr;
|
|
unsigned char *buf;
|
|
int accept_rpl_seg;
|
|
@@ -601,8 +602,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
|
|
skb_pull(skb, ((hdr->hdrlen + 1) << 3));
|
|
skb_postpull_rcsum(skb, oldhdr,
|
|
sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3));
|
|
- if (unlikely(!hdr->segments_left)) {
|
|
- if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0,
|
|
+ chdr_len = sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3);
|
|
+ if (unlikely(!hdr->segments_left ||
|
|
+ skb_headroom(skb) < chdr_len + skb->mac_len)) {
|
|
+ if (pskb_expand_head(skb, chdr_len + skb->mac_len, 0,
|
|
GFP_ATOMIC)) {
|
|
__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS);
|
|
kfree_skb(skb);
|
|
@@ -612,7 +615,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
|
|
|
|
oldhdr = ipv6_hdr(skb);
|
|
}
|
|
- skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr));
|
|
+ skb_push(skb, chdr_len);
|
|
skb_reset_network_header(skb);
|
|
skb_mac_header_rebuild(skb);
|
|
skb_set_transport_header(skb, sizeof(struct ipv6hdr));
|