* [PATCH 5.10/6.1] ipvs: reload ip header after head reallocation
@ 2026-08-28 8:55 Denis Arefev
2026-08-28 9:32 ` Breno Leitao
0 siblings, 1 reply; 2+ messages in thread
From: Denis Arefev @ 2026-08-28 8:55 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Wensong Zhang, Simon Horman, Julian Anastasov, Pablo Neira Ayuso,
Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Jakub Kicinski, Dwip Banerjee, netdev, lvs-devel,
netfilter-devel, coreteam, linux-kernel
From: Florian Westphal <fw@strlen.de>
commit a2f57827bf7c695b8c72dc4511cae8e86582369d upstream.
__ip_vs_get_out_rt() calls skb_ensure_writable() which may
reallocate skb->head.
Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
[Denis Arefev: adapted for 5.10/6.1: keep EnterFunction/LeaveFunction
instrumentation]
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
Backport fix for CVE-2026-68476
Link: https://nvd.nist.gov/vuln/detail/CVE-2026-68476
---
net/netfilter/ipvs/ip_vs_xmit.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 9e199f00eea7..29ca141e3795 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -718,15 +718,13 @@ int
ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
struct ip_vs_protocol *pp, struct ip_vs_iphdr *ipvsh)
{
- struct iphdr *iph = ip_hdr(skb);
-
EnterFunction(10);
- if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr,
- IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0)
+ if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, ip_hdr(skb)->daddr,
+ IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0)
goto tx_error;
- ip_send_check(iph);
+ ip_send_check(ip_hdr(skb));
/* Another hack: avoid icmp_send in ip_fragment */
skb->ignore_df = 1;
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH 5.10/6.1] ipvs: reload ip header after head reallocation
2026-08-28 8:55 [PATCH 5.10/6.1] ipvs: reload ip header after head reallocation Denis Arefev
@ 2026-08-28 9:32 ` Breno Leitao
0 siblings, 0 replies; 2+ messages in thread
From: Breno Leitao @ 2026-08-28 9:32 UTC (permalink / raw)
To: Denis Arefev
Cc: stable, Greg Kroah-Hartman, Wensong Zhang, Simon Horman,
Julian Anastasov, Pablo Neira Ayuso, Jozsef Kadlecsik,
Florian Westphal, David S. Miller, Jakub Kicinski, Dwip Banerjee,
netdev, lvs-devel, netfilter-devel, coreteam, linux-kernel
On Fri, Aug 28, 2026 at 11:55:21AM +0300, Denis Arefev wrote:
> From: Florian Westphal <fw@strlen.de>
>
> commit a2f57827bf7c695b8c72dc4511cae8e86582369d upstream.
>
> __ip_vs_get_out_rt() calls skb_ensure_writable() which may
> reallocate skb->head.
>
> Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-sonnet-4-6
> Acked-by: Julian Anastasov <ja@ssi.bg>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> [Denis Arefev: adapted for 5.10/6.1: keep EnterFunction/LeaveFunction
> instrumentation]
yea, the backport seems fine and match commit a2f57827bf7c69 ("ipvs:
reload ip header after head reallocation")
> Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Breno Leitao <leitao@debian.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-28 9:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-28 8:55 [PATCH 5.10/6.1] ipvs: reload ip header after head reallocation Denis Arefev
2026-08-28 9:32 ` Breno Leitao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®