- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ipv6: mcast: Fix potential UAF in MLD delayed work
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc3 commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17356 CVE: CVE-2026-72322 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU read lock and obtains the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can safely dereference inet6_dev even if its refcount has hit 0. However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the inet6_dev memory is still scheduled to be freed after the RCU grace period, the device is freed while the work is still scheduled. When the work runs, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in6_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not schedule the work. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: include/net/addrconf.h net/ipv6/mcast.c [addrconf.h: the upstream hunk context after in6_dev_hold() references ip6_ignore_linkdown(), which does not exist in 4.19, so only the new in6_dev_hold_safe() helper is added and the ip6_ignore_linkdown() context is dropped. mcast.c: 4.19 use timers (mld_gq_start_timer/mld_ifc_start_timer/ mld_dad_start_timer + mod_timer) instead of workqueue (mld_*_start_work + mod_delayed_work); igmp6_event_query/report have no workqueue queues, so those hunks are not applicable. The refcount fix is applied to the three _start_timer functions instead, preserving the upstream semantics.In 4.19, the `igmp6_event_query/report` hunks are dropped entirely (sync implementation, no workqueue queues); the target's existing refcount sites are already covered by the three `_start_timer` fixes.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/addrconf.h | 5 +++++ net/ipv6/mcast.c | 18 ++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 10d270f004f0d..26f0a5bc234be 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -425,6 +425,11 @@ static inline void in6_dev_hold(struct inet6_dev *idev) refcount_inc(&idev->refcnt); } +static inline bool in6_dev_hold_safe(struct inet6_dev *idev) +{ + return refcount_inc_not_zero(&idev->refcnt); +} + void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp); static inline void in6_ifa_put(struct inet6_ifaddr *ifp) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index bb484fe27e137..787800af097a5 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1037,8 +1037,10 @@ static void mld_gq_start_timer(struct inet6_dev *idev) unsigned long tv = prandom_u32() % idev->mc_maxdelay; idev->mc_gq_running = 1; - if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_gq_stop_timer(struct inet6_dev *idev) @@ -1052,8 +1054,10 @@ static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_ifc_stop_timer(struct inet6_dev *idev) @@ -1067,8 +1071,10 @@ static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_dad_stop_timer(struct inet6_dev *idev) -- 2.33.8

2 2

[PATCH openEuler-1.0-LTS] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
by JiangJieHua 29 Aug '26

29 Aug '26

From: Linmao Li <lilinmao(a)kylinos.cn> mainline inclusion from mainline-v7.2-rc1 commit 627ac78f2741e2ebd2225e2e953b6964a8a9182f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18025 CVE: CVE-2026-74398 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released. Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing to workqueue") Signed-off-by: Linmao Li <lilinmao(a)kylinos.cn> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260513025509.3776405-1-lilinmao@kylinos.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/addrconf.c [Contextual differences between the branch and mainline required adaptation during patch application. The functional changes from the upstream commit are preserved.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/addrconf.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 98a24b5e6f036..7b8dda47d3855 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2020,16 +2020,18 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) struct inet6_dev *idev = ifp->idev; struct net *net = dev_net(ifp->idev->dev); - if (addrconf_dad_end(ifp)) { + spin_lock_bh(&ifp->lock); + + if (ifp->state != INET6_IFADDR_STATE_DAD) { + spin_unlock_bh(&ifp->lock); in6_ifa_put(ifp); return; } + ifp->state = INET6_IFADDR_STATE_POSTDAD; net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n", ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source); - spin_lock_bh(&ifp->lock); - if (ifp->flags & IFA_F_STABLE_PRIVACY) { struct in6_addr new_addr; struct inet6_ifaddr *ifp2; @@ -2077,6 +2079,11 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) in6_ifa_put(ifp2); lock_errdad: spin_lock_bh(&ifp->lock); + if (ifp->state != INET6_IFADDR_STATE_POSTDAD) { + spin_unlock_bh(&ifp->lock); + in6_ifa_put(ifp); + return; + } } errdad: -- 2.33.8

2 3

[PATCH openEuler-1.0-LTS] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc3 commit 7b19c0f81ed1fdaec6bc522569be367199a9edf3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9704 CVE: CVE-2026-72323 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP timer callback. During device destruction, inetdev_destroy() drops the primary reference to in_device, which can drop its refcount to 0. The actual freeing of in_device memory is deferred via RCU (using call_rcu()). Concurrently, igmp_rcv() runs under RCU read lock and obtains the in_device pointer. Because the memory is RCU-protected, CPU-0 can safely dereference in_device even if its refcount has hit 0. However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it attempts to acquire a reference using in_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the in_device memory is still scheduled to be freed after the RCU grace period (as the free callback does not check the refcount again), the device is freed while the timer is still armed. When the timer expires, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not arm the timer. A similar issue in IPv6 MLD is fixed in a subsequent patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Zero Day Initiative <zdi-disclosures(a)trendmicro.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ipv4/igmp.c [For 4.19, get_random_u32_below() is not available, so igmp_ifc_start_timer() retains the original prandom_u32() % delay approach. The remaining refcount logic and the newly added in_dev_hold_safe() parts are consistent with upstream.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/linux/inetdevice.h | 5 +++++ net/ipv4/igmp.c | 14 +++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h index a64f21a97369a..002f1de9a30f4 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -255,6 +255,11 @@ static inline void in_dev_put(struct in_device *idev) #define __in_dev_put(idev) refcount_dec(&(idev)->refcnt) #define in_dev_hold(idev) refcount_inc(&(idev)->refcnt) +static inline bool in_dev_hold_safe(struct in_device *idev) +{ + return refcount_inc_not_zero(&idev->refcnt); +} + #endif /* __KERNEL__ */ static __inline__ __be32 inet_make_mask(int logmask) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c4b396968acd6..ed9ef8430c14f 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -237,16 +237,20 @@ static void igmp_gq_start_timer(struct in_device *in_dev) return; in_dev->mr_gq_running = 1; - if (!mod_timer(&in_dev->mr_gq_timer, exp)) - in_dev_hold(in_dev); + if (in_dev_hold_safe(in_dev)) { + if (mod_timer(&in_dev->mr_gq_timer, exp)) + in_dev_put(in_dev); + } } static void igmp_ifc_start_timer(struct in_device *in_dev, int delay) { - int tv = prandom_u32() % delay; + if (in_dev_hold_safe(in_dev)) { + int tv = prandom_u32() % (delay); - if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2)) - in_dev_hold(in_dev); + if (mod_timer(&in_dev->mr_ifc_timer, jiffies + tv + 2)) + in_dev_put(in_dev); + } } static void igmp_mod_timer(struct ip_mc_list *im, int max_delay) -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit f803c086399da277b5d0ff36a107d0f162751800 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18284 CVE: CVE-2026-74597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d85cf5 ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.178573656… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 7cec56b336eee..021c62c5bdcf8 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -680,6 +680,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by outer IPv6 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit f803c086399da277b5d0ff36a107d0f162751800 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18284 CVE: CVE-2026-74597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d85cf5 ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.178573656… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 7cec56b336eee..021c62c5bdcf8 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -680,6 +680,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by outer IPv6 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] netfilter: require Ethernet MAC header before using eth_hdr()
by superdcc97＠163.com 28 Aug '26

28 Aug '26

From: Zhengchuan Liang <zcliangcn(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit 62443dc21114c0bbc476fa62973db89743f2f137 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15825 CVE: CVE-2026-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal <fw(a)strlen.de> Tested-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: net/netfilter/nf_log_syslog.c net/ipv4/netfilter/nf_log_arp.c net/ipv4/netfilter/nf_log_ipv4.c net/ipv6/netfilter/nf_log_ipv6.c [commit f11d61e7957d is not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_log_arp.c | 5 ++++- net/ipv4/netfilter/nf_log_ipv4.c | 3 +++ net/ipv6/netfilter/ip6t_eui64.c | 7 +++++-- net/ipv6/netfilter/nf_log_ipv6.c | 3 +++ net/netfilter/ipset/ip_set_bitmap_ipmac.c | 5 +++-- net/netfilter/ipset/ip_set_hash_ipmac.c | 9 +++++---- net/netfilter/ipset/ip_set_hash_mac.c | 5 +++-- net/netfilter/xt_mac.c | 4 +--- 8 files changed, 27 insertions(+), 14 deletions(-) diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c index 19fff2c589fa..fb10209c9a45 100644 --- a/net/ipv4/netfilter/nf_log_arp.c +++ b/net/ipv4/netfilter/nf_log_arp.c @@ -63,7 +63,10 @@ static void dump_arp_packet(struct nf_log_buf *m, else logflags = NF_LOG_DEFAULT_MASK; - if (logflags & NF_LOG_MACDECODE) { + if ((logflags & NF_LOG_MACDECODE) && + skb->dev && skb->dev->type == ARPHRD_ETHER && + skb_mac_header_was_set(skb) && + skb_mac_header_len(skb) >= ETH_HLEN) { nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c index faa1ca357d0c..7cc8e5d7528c 100644 --- a/net/ipv4/netfilter/nf_log_ipv4.c +++ b/net/ipv4/netfilter/nf_log_ipv4.c @@ -287,6 +287,9 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index cda3d43e527d..96273dcdc54c 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/skbuff.h> #include <linux/ipv6.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netfilter/x_tables.h> @@ -24,8 +25,10 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) { unsigned char eui64[8]; - if (!(skb_mac_header(skb) >= skb->head && - skb_mac_header(skb) + ETH_HLEN <= skb->data)) { + if (!skb->dev || skb->dev->type != ARPHRD_ETHER) + return false; + + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) { par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c index 4edf73b5c8e5..7bd36cb23fa1 100644 --- a/net/ipv6/netfilter/nf_log_ipv6.c +++ b/net/ipv6/netfilter/nf_log_ipv6.c @@ -300,6 +300,9 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c index 9669cace4522..153f8dec9ca5 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c +++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c @@ -15,6 +15,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netlink.h> #include <linux/jiffies.h> @@ -224,8 +225,8 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, return -IPSET_ERR_BITMAP_RANGE; /* Backward compatibility: we don't check the second flag */ - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; e.id = ip_to_id(map, ip); diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c index f2c2f72e2fff..b7b98b129315 100644 --- a/net/netfilter/ipset/ip_set_hash_ipmac.c +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c @@ -14,6 +14,7 @@ #include <linux/skbuff.h> #include <linux/errno.h> #include <linux/random.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/ip.h> #include <net/ipv6.h> @@ -92,8 +93,8 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) @@ -208,8 +209,8 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c index 4fe5f243d0a3..ccb925f82fa7 100644 --- a/net/netfilter/ipset/ip_set_hash_mac.c +++ b/net/netfilter/ipset/ip_set_hash_mac.c @@ -12,6 +12,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/netlink.h> @@ -81,8 +82,8 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_ONE_SRC) diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c index d5b4fd4f91ed..df42d0233d73 100644 --- a/net/netfilter/xt_mac.c +++ b/net/netfilter/xt_mac.c @@ -32,9 +32,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par) if (skb->dev == NULL || skb->dev->type != ARPHRD_ETHER) return false; - if (skb_mac_header(skb) < skb->head) - return false; - if (skb_mac_header(skb) + ETH_HLEN > skb->data) + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return false; ret = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr); ret ^= info->invert; -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] net: LTS-6.6.90 backport
by Dong Chenchen 28 Aug '26

28 Aug '26

net: LTS-6.6.90 backport Abhishek Chauhan (1): net: Rename mono_delivery_time to tstamp_type for scalabilty Dong Chenchen (1): net: Fix kabi breakage of struct sk_buff and inet_frag_queue Pauli Virtanen (1): Bluetooth: L2CAP: copy RX timestamp to new fragments include/linux/skbuff.h | 54 +++++++++++++++++----- include/net/inet_frag.h | 4 +- net/bluetooth/l2cap_core.c | 3 ++ net/bridge/netfilter/nf_conntrack_bridge.c | 6 +-- net/core/dev.c | 2 +- net/core/filter.c | 10 ++-- net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/inet_fragment.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 9 ++-- net/ipv4/tcp_output.c | 14 +++--- net/ipv6/ip6_output.c | 6 +-- net/ipv6/netfilter.c | 6 +-- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/reassembly.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- net/sched/act_bpf.c | 4 +- net/sched/cls_bpf.c | 4 +- 18 files changed, 84 insertions(+), 50 deletions(-) -- 2.25.1

2 4