82 lines
2.9 KiB
Diff
82 lines
2.9 KiB
Diff
From a3f61eef6943577933d43f3546d57ae78f5b44f3 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:22:55 +0200
|
|
Subject: [PATCH] netfilter: replace skb_try_make_writable() by
|
|
skb_ensure_writable()
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 1049970d7583
|
|
|
|
commit 1049970d7583194eedc30e45a3c898b2cb1c30ba
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Mon Apr 27 14:34:45 2026 +0200
|
|
|
|
netfilter: replace skb_try_make_writable() by skb_ensure_writable()
|
|
|
|
skb_try_make_writable() only works on clones and uncloned packets might
|
|
have their network header in paged fragments.
|
|
|
|
nft_fwd needs to work for the ingress and egress hooks, but the egress
|
|
hook where skb->data points to the mac header, use skb_network_offset()
|
|
to include the mac header. The flowtable is fine since it already uses
|
|
the transport offset.
|
|
|
|
Fixes: d32de98ea70f ("netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer")
|
|
Fixes: 7d2086871762 ("netfilter: nf_flow_table: move ipv4 offload hook code to nf_flow_table")
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
|
|
index 8cd4cf7..43266ab 100644
|
|
--- a/net/netfilter/nf_flow_table_ip.c
|
|
+++ b/net/netfilter/nf_flow_table_ip.c
|
|
@@ -394,7 +394,7 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx,
|
|
return 0;
|
|
}
|
|
|
|
- if (skb_try_make_writable(skb, thoff + ctx->hdrsize))
|
|
+ if (skb_ensure_writable(skb, thoff + ctx->hdrsize))
|
|
return -1;
|
|
|
|
flow_offload_refresh(flow_table, flow, false);
|
|
@@ -673,7 +673,7 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx,
|
|
return 0;
|
|
}
|
|
|
|
- if (skb_try_make_writable(skb, thoff + ctx->hdrsize))
|
|
+ if (skb_ensure_writable(skb, thoff + ctx->hdrsize))
|
|
return -1;
|
|
|
|
flow_offload_refresh(flow_table, flow, false);
|
|
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
|
|
index 152a9fb..c49da00 100644
|
|
--- a/net/netfilter/nft_fwd_netdev.c
|
|
+++ b/net/netfilter/nft_fwd_netdev.c
|
|
@@ -100,6 +100,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
|
|
int oif = regs->data[priv->sreg_dev];
|
|
unsigned int verdict = NF_STOLEN;
|
|
struct sk_buff *skb = pkt->skb;
|
|
+ int nhoff = skb_network_offset(skb);
|
|
struct net_device *dev;
|
|
int neigh_table;
|
|
|
|
@@ -111,7 +112,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
|
|
verdict = NFT_BREAK;
|
|
goto out;
|
|
}
|
|
- if (skb_try_make_writable(skb, sizeof(*iph))) {
|
|
+ if (skb_ensure_writable(skb, nhoff + sizeof(*iph))) {
|
|
verdict = NF_DROP;
|
|
goto out;
|
|
}
|
|
@@ -127,7 +128,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
|
|
verdict = NFT_BREAK;
|
|
goto out;
|
|
}
|
|
- if (skb_try_make_writable(skb, sizeof(*ip6h))) {
|
|
+ if (skb_ensure_writable(skb, nhoff + sizeof(*ip6h))) {
|
|
verdict = NF_DROP;
|
|
goto out;
|
|
}
|