Skip to content

[ciqlts9_2] Multiple patches tested (5 commits) #1697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PlaidCat merged 5 commits into from
Oct 14, 2026
Merged

[ciqlts9_2] Multiple patches tested (5 commits) #1697

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
915f869
xfrm: input: hold netns during deferred transport reinjection
Oct 14, 2026
0835185
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Oct 14, 2026
0c8310e
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Oct 14, 2026
956ef09
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_…
Oct 14, 2026
e224aa5
udp: fix potential use-after-free in tunnel segmentation
Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion net/ipv4/udp_offload.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,17 +21,19 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
bool remcsum, need_csum, offload_csum, gso_partial;
struct sk_buff *segs = ERR_PTR(-EINVAL);
struct udphdr *uh = udp_hdr(skb);
u16 mac_offset = skb->mac_header;
__be16 protocol = skb->protocol;
u16 mac_len = skb->mac_len;
int udp_offset, outer_hlen;
struct udphdr *uh;
__wsum partial;
bool need_ipsec;

if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
goto out;

uh = udp_hdr(skb);

/* Adjust partial header checksum to negate old length.
* We cannot rely on the value contained in uh->len as it is
* possible that the actual value exceeds the boundaries of the
Expand Down
23 changes: 16 additions & 7 deletions net/ipv6/ip6_vti.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -728,10 +728,11 @@ vti6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p,
static int vti6_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p,
bool keep_mtu)
{
struct net *net = dev_net(t->dev);
struct vti6_net *ip6n = net_generic(net, vti6_net_id);
struct net *net = t->net;
struct vti6_net *ip6n;
int err;

ip6n = net_generic(net, vti6_net_id);
vti6_tnl_unlink(ip6n, t);
synchronize_net();
err = vti6_tnl_change(t, p, keep_mtu);
Expand Down Expand Up @@ -840,17 +841,24 @@ vti6_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __user *data
if (p.proto != IPPROTO_IPV6 && p.proto != 0)
break;
vti6_parm_from_user(&p1, &p);
t = vti6_locate(net, &p1, cmd == SIOCADDTUNNEL);
if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
struct ip6_tnl *self = netdev_priv(dev);

err = -EPERM;
if (!ns_capable(self->net->user_ns, CAP_NET_ADMIN))
break;
t = vti6_locate(self->net, &p1, false);
if (t) {
if (t->dev != dev) {
err = -EEXIST;
break;
}
} else
t = netdev_priv(dev);
t = self;

err = vti6_update(t, &p1, false);
} else {
t = vti6_locate(net, &p1, cmd == SIOCADDTUNNEL);
}
if (t) {
err = 0;
Expand Down Expand Up @@ -1037,11 +1045,12 @@ static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
struct nlattr *data[],
struct netlink_ext_ack *extack)
{
struct ip6_tnl *t;
struct ip6_tnl *t = netdev_priv(dev);
struct net *net = t->net;
struct __ip6_tnl_parm p;
struct net *net = dev_net(dev);
struct vti6_net *ip6n = net_generic(net, vti6_net_id);
struct vti6_net *ip6n;

ip6n = net_generic(net, vti6_net_id);
if (dev == ip6n->fb_tnl_dev)
return -EINVAL;

Expand Down
16 changes: 12 additions & 4 deletions net/xfrm/xfrm_input.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -773,9 +773,12 @@ static void xfrm_trans_reinject(struct work_struct *work)
spin_unlock_bh(&trans->queue_lock);

local_bh_disable();
while ((skb = __skb_dequeue(&queue)))
XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net,
NULL, skb);
while ((skb = __skb_dequeue(&queue))) {
struct net *net = XFRM_TRANS_SKB_CB(skb)->net;

XFRM_TRANS_SKB_CB(skb)->finish(net, NULL, skb);
put_net(net);
}
local_bh_enable();
}

Expand All @@ -784,6 +787,7 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
struct sk_buff *))
{
struct xfrm_trans_tasklet *trans;
struct net *hold_net;

trans = this_cpu_ptr(&xfrm_trans_tasklet);

Expand All @@ -792,8 +796,12 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,

BUILD_BUG_ON(sizeof(struct xfrm_trans_cb) > sizeof(skb->cb));

hold_net = maybe_get_net(net);
if (!hold_net)
return -ENODEV;

XFRM_TRANS_SKB_CB(skb)->finish = finish;
XFRM_TRANS_SKB_CB(skb)->net = net;
XFRM_TRANS_SKB_CB(skb)->net = hold_net;
spin_lock_bh(&trans->queue_lock);
__skb_queue_tail(&trans->queue, skb);
spin_unlock_bh(&trans->queue_lock);
Expand Down
13 changes: 2 additions & 11 deletions net/xfrm/xfrm_policy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1103,15 +1103,6 @@ static void __xfrm_policy_inexact_prune_bin(struct xfrm_pol_inexact_bin *b, bool
}
}

static void xfrm_policy_inexact_prune_bin(struct xfrm_pol_inexact_bin *b)
{
struct net *net = read_pnet(&b->k.net);

spin_lock_bh(&net->xfrm.xfrm_policy_lock);
__xfrm_policy_inexact_prune_bin(b, false);
spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
}

static void __xfrm_policy_inexact_flush(struct net *net)
{
struct xfrm_pol_inexact_bin *bin, *t;
Expand Down Expand Up @@ -1698,12 +1689,12 @@ xfrm_policy_bysel_ctx(struct net *net, const struct xfrm_mark *mark, u32 if_id,
}
ret = pol;
}
if (bin && delete)
__xfrm_policy_inexact_prune_bin(bin, false);
spin_unlock_bh(&net->xfrm.xfrm_policy_lock);

if (ret && delete)
xfrm_policy_kill(ret);
if (bin && delete)
xfrm_policy_inexact_prune_bin(bin);
return ret;
}
EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
Expand Down
Loading