hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15014 CVE: CVE-2026-43456 -------------------------------- Add dev_parse to header_ops to fix kabi breakage. eth, ipgre, mac802154, pn header_parse dont use dev param, so we remove dev param and still use parse func pointer. Fixes: b7405dcf7385 ("bonding: prevent potential infinite loop in bond_header_parse()") Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> --- drivers/firewire/net.c | 5 ++--- drivers/net/bonding/bond_main.c | 10 +++++++--- drivers/net/wireless/cisco/airo.c | 3 +-- .../wireless/intersil/hostap/hostap_main.c | 1 - include/linux/etherdevice.h | 3 +-- include/linux/if_ether.h | 3 +-- include/linux/netdevice.h | 19 ++++++++++++------- net/ethernet/eth.c | 9 ++++++--- net/ipv4/ip_gre.c | 3 +-- net/mac802154/iface.c | 4 +--- net/phonet/af_phonet.c | 5 +---- 11 files changed, 33 insertions(+), 32 deletions(-) diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c index 21f3a9dae072..7a4d1a478e33 100644 --- a/drivers/firewire/net.c +++ b/drivers/firewire/net.c @@ -257,10 +257,9 @@ static void fwnet_header_cache_update(struct hh_cache *hh, memcpy((u8 *)hh->hh_data + HH_DATA_OFF(FWNET_HLEN), haddr, net->addr_len); } -static int fwnet_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr) +static int fwnet_header_parse(const struct sk_buff *skb, unsigned char *haddr) { - memcpy(haddr, dev->dev_addr, FWNET_ALEN); + memcpy(haddr, skb->dev->dev_addr, FWNET_ALEN); return FWNET_ALEN; } diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index d10e6e57c0ce..b2615d102c90 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1584,8 +1584,12 @@ static int bond_header_parse(const struct sk_buff *skb, slave = rcu_dereference(bond->curr_active_slave); if (slave) { slave_ops = READ_ONCE(slave->dev->header_ops); - if (slave_ops && slave_ops->parse) - ret = slave_ops->parse(skb, slave->dev, haddr); + if (slave_ops) { + if (slave_ops->dev_parse) + ret = slave_ops->dev_parse(skb, slave->dev, haddr); + else if (slave_ops->parse) + ret = slave_ops->parse(skb, haddr); + } } rcu_read_unlock(); return ret; @@ -1593,7 +1597,7 @@ static int bond_header_parse(const struct sk_buff *skb, static const struct header_ops bond_header_ops = { .create = bond_header_create, - .parse = bond_header_parse, + .dev_parse = bond_header_parse, }; static void bond_setup_by_slave(struct net_device *bond_dev, diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c index c318d01223f9..dbd13f7aa3e6 100644 --- a/drivers/net/wireless/cisco/airo.c +++ b/drivers/net/wireless/cisco/airo.c @@ -2437,8 +2437,7 @@ void stop_airo_card(struct net_device *dev, int freeres) EXPORT_SYMBOL(stop_airo_card); -static int wll_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr) +static int wll_header_parse(const struct sk_buff *skb, unsigned char *haddr) { memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); return ETH_ALEN; diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c index 8ba1a709fe47..787f685e70b4 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_main.c +++ b/drivers/net/wireless/intersil/hostap/hostap_main.c @@ -575,7 +575,6 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx) static int hostap_80211_header_parse(const struct sk_buff *skb, - const struct net_device *dev, unsigned char *haddr) { memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */ diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h index ec74ab0c9138..e44913a8200f 100644 --- a/include/linux/etherdevice.h +++ b/include/linux/etherdevice.h @@ -42,8 +42,7 @@ extern const struct header_ops eth_header_ops; int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type, const void *daddr, const void *saddr, unsigned len); -int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr); +int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr); int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16 type); void eth_header_cache_update(struct hh_cache *hh, const struct net_device *dev, diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h index 47a0feffc121..8a9792a6427a 100644 --- a/include/linux/if_ether.h +++ b/include/linux/if_ether.h @@ -37,8 +37,7 @@ static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb) return (struct ethhdr *)skb_inner_mac_header(skb); } -int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr); +int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr); extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len); diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index fb72971da384..3489318d0a07 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -313,9 +313,7 @@ struct header_ops { int (*create) (struct sk_buff *skb, struct net_device *dev, unsigned short type, const void *daddr, const void *saddr, unsigned int len); - int (*parse)(const struct sk_buff *skb, - const struct net_device *dev, - unsigned char *haddr); + int (*parse)(const struct sk_buff *skb, unsigned char *haddr); int (*cache)(const struct neighbour *neigh, struct hh_cache *hh, __be16 type); void (*cache_update)(struct hh_cache *hh, const struct net_device *dev, @@ -323,7 +321,9 @@ struct header_ops { bool (*validate)(const char *ll_header, unsigned int len); __be16 (*parse_protocol)(const struct sk_buff *skb); - KABI_RESERVE(1) + KABI_USE(1, int (*dev_parse)(const struct sk_buff *skb, + const struct net_device *dev, + unsigned char *haddr)) KABI_RESERVE(2) }; @@ -3220,9 +3220,14 @@ static inline int dev_parse_header(const struct sk_buff *skb, { const struct net_device *dev = skb->dev; - if (!dev->header_ops || !dev->header_ops->parse) - return 0; - return dev->header_ops->parse(skb, dev, haddr); + if (dev->header_ops) { + if (dev->header_ops->dev_parse) + return dev->header_ops->dev_parse(skb, dev, haddr); + else if (dev->header_ops->parse) + return dev->header_ops->parse(skb, haddr); + } + + return 0; } static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb) diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c index b11ce2e7584f..4d9aeb319d0e 100644 --- a/net/ethernet/eth.c +++ b/net/ethernet/eth.c @@ -198,11 +198,14 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev) } EXPORT_SYMBOL(eth_type_trans); -int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr) +/** + * eth_header_parse - extract hardware address from packet + * @skb: packet to extract header from + * @haddr: destination buffer + */ +int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr) { const struct ethhdr *eth = eth_hdr(skb); - memcpy(haddr, eth->h_source, ETH_ALEN); return ETH_ALEN; } diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index fbe554a6fafa..75d388dd5ac6 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -888,8 +888,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev, return -(t->hlen + sizeof(*iph)); } -static int ipgre_header_parse(const struct sk_buff *skb, const struct net_device *dev, - unsigned char *haddr) +static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr) { const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb); memcpy(haddr, &iph->saddr, 4); diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c index 000be60d9580..9e4631fade90 100644 --- a/net/mac802154/iface.c +++ b/net/mac802154/iface.c @@ -469,9 +469,7 @@ static int mac802154_header_create(struct sk_buff *skb, } static int -mac802154_header_parse(const struct sk_buff *skb, - const struct net_device *dev, - unsigned char *haddr) +mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr) { struct ieee802154_hdr hdr; diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index e38fad4144e4..2b582da1e88c 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -129,12 +129,9 @@ static int pn_header_create(struct sk_buff *skb, struct net_device *dev, return 1; } -static int pn_header_parse(const struct sk_buff *skb, - const struct net_device *dev, - unsigned char *haddr) +static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr) { const u8 *media = skb_mac_header(skb); - *haddr = *media; return 1; } -- 2.25.1