From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 14:48:52 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.1.179~11 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=015687caa582a9be2c40d4cb4c0406f64d490df8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: ila-reload-ipv6-header-after-pskb_may_pull-in-checksum-adjust.patch mac802154-llsec-reject-frames-shorter-than-the-authentication-tag.patch pppoe-reload-header-pointer-after-dev_hard_header.patch tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch --- diff --git a/queue-5.10/ila-reload-ipv6-header-after-pskb_may_pull-in-checksum-adjust.patch b/queue-5.10/ila-reload-ipv6-header-after-pskb_may_pull-in-checksum-adjust.patch new file mode 100644 index 0000000000..9feade51a0 --- /dev/null +++ b/queue-5.10/ila-reload-ipv6-header-after-pskb_may_pull-in-checksum-adjust.patch @@ -0,0 +1,83 @@ +From 92d3817649df2b0b6a008a686c8275c88d7ef594 Mon Sep 17 00:00:00 2001 +From: Michael Bommarito +Date: Tue, 14 Jul 2026 07:49:03 -0400 +Subject: ila: reload IPv6 header after pskb_may_pull in checksum adjust + +From: Michael Bommarito + +commit 92d3817649df2b0b6a008a686c8275c88d7ef594 upstream. + +ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling +pskb_may_pull(). On a non-linear skb whose transport header sits in a page +fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() +and free the old skb head, leaving ip6h dangling; the following +get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() +uses ip6h (and the iaddr derived from it) again after the csum-adjust +call and additionally writes the new locator through that pointer. + +Impact: a remote IPv6 packet routed through a configured ILA +csum-adjust-transport route or receive-side mapping triggers a +slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or +mapping requires CAP_NET_ADMIN to configure, but trigger packets are +unauthenticated once it exists. + +Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() +before the csum-diff read. In ila_update_ipv6_locator() only the +ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in +that case alone before the destination-address write; the neutral-map +modes never pull and keep their cached pointers. + +Fixes: 33f11d16142b ("ila: Create net/ipv6/ila directory") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Bommarito +Reviewed-by: Simon Horman +Reviewed-by: Antoine Tenart +Link: https://patch.msgid.link/20260714114903.3763420-1-michael.bommarito@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ila/ila_common.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/net/ipv6/ila/ila_common.c ++++ b/net/ipv6/ila/ila_common.c +@@ -84,6 +84,7 @@ static void ila_csum_adjust_transport(st + struct tcphdr *th = (struct tcphdr *) + (skb_network_header(skb) + nhoff); + ++ ip6h = ipv6_hdr(skb); + diff = get_csum_diff(ip6h, p); + inet_proto_csum_replace_by_diff(&th->check, skb, + diff, true, true); +@@ -95,6 +96,7 @@ static void ila_csum_adjust_transport(st + (skb_network_header(skb) + nhoff); + + if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) { ++ ip6h = ipv6_hdr(skb); + diff = get_csum_diff(ip6h, p); + inet_proto_csum_replace_by_diff(&uh->check, skb, + diff, true, true); +@@ -109,6 +111,7 @@ static void ila_csum_adjust_transport(st + struct icmp6hdr *ih = (struct icmp6hdr *) + (skb_network_header(skb) + nhoff); + ++ ip6h = ipv6_hdr(skb); + diff = get_csum_diff(ip6h, p); + inet_proto_csum_replace_by_diff(&ih->icmp6_cksum, skb, + diff, true, true); +@@ -126,6 +129,15 @@ void ila_update_ipv6_locator(struct sk_b + switch (p->csum_mode) { + case ILA_CSUM_ADJUST_TRANSPORT: + ila_csum_adjust_transport(skb, p); ++ /* ++ * ila_csum_adjust_transport() calls pskb_may_pull(), which can ++ * reallocate the skb head and leave ip6h (and the iaddr derived ++ * from it) dangling; reload both before the write below. The ++ * other csum modes do not pull, so their cached pointers stay ++ * valid. ++ */ ++ ip6h = ipv6_hdr(skb); ++ iaddr = ila_a2i(&ip6h->daddr); + break; + case ILA_CSUM_NEUTRAL_MAP: + if (sir2ila) { diff --git a/queue-5.10/mac802154-llsec-reject-frames-shorter-than-the-authentication-tag.patch b/queue-5.10/mac802154-llsec-reject-frames-shorter-than-the-authentication-tag.patch new file mode 100644 index 0000000000..9875917681 --- /dev/null +++ b/queue-5.10/mac802154-llsec-reject-frames-shorter-than-the-authentication-tag.patch @@ -0,0 +1,55 @@ +From fd3a3f28ed60c6af4b2a39933b151d6b27842c3b Mon Sep 17 00:00:00 2001 +From: Doruk Tan Ozturk +Date: Thu, 16 Jul 2026 21:34:23 +0200 +Subject: mac802154: llsec: reject frames shorter than the authentication tag + +From: Doruk Tan Ozturk + +commit fd3a3f28ed60c6af4b2a39933b151d6b27842c3b upstream. + +llsec_do_decrypt_auth() computes the associated-data length for the +AEAD request as + + assoclen += datalen - authlen; + +where datalen is the number of bytes after the MAC header and authlen +(4, 8 or 16) is the length of the authentication tag. Nothing verifies +that the frame actually carries at least authlen payload bytes. A +secured frame whose payload is shorter than the tag makes +datalen - authlen negative; assoclen is then passed to +aead_request_set_ad() as an unsigned value close to 4 GiB, so +crypto_aead_decrypt() walks far off the end of the scatterlist that +only spans the real frame. + +The frame is fully attacker-controlled and reaches this path from any +IEEE 802.15.4 peer in radio range. Reject frames whose payload is +shorter than the authentication tag before the subtraction. + +Dynamically reproduced on a KASAN kernel as a general-protection-fault +in the AEAD scatterwalk, and the fix confirmed. + +Fixes: 4c14a2fb5d14 ("mac802154: add llsec decryption method") +Cc: stable@vger.kernel.org +Reviewed-by: Simon Horman +Signed-off-by: Doruk Tan Ozturk +Link: https://patch.msgid.link/20260716193423.32498-1-doruk@0sec.ai +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mac802154/llsec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/mac802154/llsec.c ++++ b/net/mac802154/llsec.c +@@ -888,6 +888,11 @@ llsec_do_decrypt_auth(struct sk_buff *sk + data = skb_mac_header(skb) + skb->mac_len; + datalen = skb_tail_pointer(skb) - data; + ++ if (datalen < authlen) { ++ kfree_sensitive(req); ++ return -EBADMSG; ++ } ++ + sg_init_one(&sg, skb_mac_header(skb), assoclen + datalen); + + if (!(hdr->sec.level & IEEE802154_SCF_SECLEVEL_ENC)) { diff --git a/queue-5.10/pppoe-reload-header-pointer-after-dev_hard_header.patch b/queue-5.10/pppoe-reload-header-pointer-after-dev_hard_header.patch new file mode 100644 index 0000000000..71a5a07f74 --- /dev/null +++ b/queue-5.10/pppoe-reload-header-pointer-after-dev_hard_header.patch @@ -0,0 +1,44 @@ +From e9c238f6fe42fb1b4dba3a578277de32cb487937 Mon Sep 17 00:00:00 2001 +From: Asim Viladi Oglu Manizada +Date: Wed, 22 Jul 2026 09:38:43 +0000 +Subject: pppoe: reload header pointer after dev_hard_header() + +From: Asim Viladi Oglu Manizada + +commit e9c238f6fe42fb1b4dba3a578277de32cb487937 upstream. + +pppoe_sendmsg() saves a pointer to the PPPoE header before calling +dev_hard_header(). Device header callbacks are allowed to reallocate the +skb head, invalidating pointers into it. + +This can happen when a send is blocked in copy_from_user() while the first +non-Ethernet port is added to an empty team device. The team's delegated +GRE header callback then expands the skb head. PPPoE subsequently writes +six bytes through the stale pointer into the freed head. + +Reload the PPPoE header through the skb's network-header offset after +device header creation. pskb_expand_head() updates that offset when it +relocates the head. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Asim Viladi Oglu Manizada +Reviewed-by: Vadim Fedorenko +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/pppoe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -899,6 +899,7 @@ static int pppoe_sendmsg(struct socket * + dev_hard_header(skb, dev, ETH_P_PPP_SES, + po->pppoe_pa.remote, NULL, total_len); + ++ ph = pppoe_hdr(skb); + memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); + + ph->length = htons(total_len); diff --git a/queue-5.10/series b/queue-5.10/series index 66445bb3e1..f8b3f36150 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -178,3 +178,7 @@ net-hip04-fix-rx-buffer-leak-on-build_skb-failure.patch proc-fix-broken-error-paths-for-namespace-links.patch selftests-ftrace-reset-triggers-at-top-level-before-instance-loop.patch rbd-reset-positive-result-codes-to-zero-in-object-map-update-path.patch +ila-reload-ipv6-header-after-pskb_may_pull-in-checksum-adjust.patch +mac802154-llsec-reject-frames-shorter-than-the-authentication-tag.patch +pppoe-reload-header-pointer-after-dev_hard_header.patch +tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch diff --git a/queue-5.10/tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch b/queue-5.10/tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch new file mode 100644 index 0000000000..0da41ae718 --- /dev/null +++ b/queue-5.10/tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch @@ -0,0 +1,82 @@ +From ba0533fc163f905fe817cfabdf8ed4058da44800 Mon Sep 17 00:00:00 2001 +From: Daehyeon Ko <4ncienth@gmail.com> +Date: Tue, 14 Jul 2026 22:19:39 +0900 +Subject: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() + +From: Daehyeon Ko <4ncienth@gmail.com> + +commit ba0533fc163f905fe817cfabdf8ed4058da44800 upstream. + +When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() +returns non-zero), its error path frees the sk with sk_free() but leaves +sock->sk pointing at the freed object: + + if (tipc_sk_insert(tsk)) { + sk_free(sk); + pr_warn("Socket create failed; port number exhausted\n"); + return -EINVAL; + } + +This is harmless for plain socket(): the syscall layer clears sock->ops +before releasing, so tipc_release() is never called. It is not harmless +on the accept() path. tipc_accept() creates the pre-allocated child +socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves +new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then +fput()s the new file, so __sock_release() -> tipc_release() runs +lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the +sk_lock spinlock. + +tipc_release() already guards this exact "failed accept() releases a +pre-allocated child" case with "if (sk == NULL) return 0;", but the +guard is bypassed because tipc_sk_create() left sock->sk non-NULL +(dangling) rather than NULL. + +Clear sock->sk on the failed-insert path so the existing tipc_release() +NULL check fires and the use-after-free is avoided. + +The tipc_sk_insert() failure is reached when the per-netns socket +rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M +elements) -- i.e. once a netns holds ~2M TIPC sockets every insert +returns -E2BIG. + + BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839) + Write of size 8 at addr ffff8880047cdc38 by task init/1 + lock_sock_nested (net/core/sock.c:3839) + tipc_release (net/tipc/socket.c:638) + __sock_release (net/socket.c:710) + sock_close (net/socket.c:1501) + __fput (fs/file_table.c:512) + Allocated by task 1: + sk_alloc (net/core/sock.c:2308) + tipc_sk_create (net/tipc/socket.c:487) + tipc_accept (net/tipc/socket.c:2744) + do_accept (net/socket.c:2034) + Freed by task 1: + __sk_destruct (net/core/sock.c:2391) + tipc_sk_create (net/tipc/socket.c:504) + tipc_accept (net/tipc/socket.c:2744) + do_accept (net/socket.c:2034) + +Fixes: 00aff3590fc0 ("net: tipc: fix possible refcount leak in tipc_sk_create()") +Cc: stable@vger.kernel.org +Reviewed-by: Tung Nguyen +Reviewed-by: Breno Leitao +Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260714131939.1255974-1-4ncienth@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/socket.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -490,6 +490,7 @@ static int tipc_sk_create(struct net *ne + tipc_set_sk_state(sk, TIPC_OPEN); + if (tipc_sk_insert(tsk)) { + sk_free(sk); ++ sock->sk = NULL; + pr_warn("Socket create failed; port number exhausted\n"); + return -EINVAL; + }