From: Jakub Kicinski Date: Wed, 22 Jul 2026 14:51:49 +0000 (-0700) Subject: Merge branch 'amt-fix-use-after-free-of-the-skb-head-across-pulls' X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=06ec76fa534a2330fecb66deaa09be4db7ac620c;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'amt-fix-use-after-free-of-the-skb-head-across-pulls' Michael Bommarito says: ==================== amt: fix use-after-free of the skb head across pulls Several AMT receive and transmit paths cache a pointer into the skb head and then call a helper that can reallocate that head before the cached pointer is used again, so the later access reads or writes freed memory. Patch 1 walks every AMT path and, for each pointer used after a reallocating call, either snapshots the value before the first pull or re-derives the pointer after the last one. Patch 2 is a smaller, separable hardening change: the three handlers that rewrite the ethernet header do so in place without making the head private, which corrupts a cloned skb (for example one held by a packet tap). It adds skb_cow_head() before the rewrite, split out so the use-after-free fix is not held up by discussion of the clone case. ==================== Link: https://patch.msgid.link/20260711151934.2955226-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski --- 06ec76fa534a2330fecb66deaa09be4db7ac620c