From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from omta38.uswest2.a.cloudfilter.net (omta38.uswest2.a.cloudfilter.net [35.89.44.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 407913264F2 for ; Fri, 8 May 2026 19:07:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=35.89.44.37 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778267273; cv=none; b=AcYEYu7OBYuxewrkOHt6waoxgnKN1tBxgZ5QtfyWCaPvH6y6Ul5hgijwRXRKzGl5rfhcOXaMQWxYokajpK0hpM+Ap4yu5XQC9K7ca5kNXCo4PRFZy6YDJi+fqJAFQaPICw1bban+YGHXDK4wFCnC8b7lcYwWkmaVCm4BnXxTehQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778267273; c=relaxed/simple; bh=dHqbDz+QQ5BQjxxoqqdjxkptKnCx0juEhtkkEmz8g30=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Xk2BrkLJuFrzA1k5Lkh2P+UegaUyNkmsivFEnjXPHHe9yDW/F4eplr4PYRnoqxL1k6WPeEPhnz/Afl6FVtcZ7q1WKGog5WT5bmX2tgGiFe+Iv5pfI+q0L1XnXOeT4/StW+OKfghosQrhjvogkN6IKUXpQe7+vjG0hx0z3SJORJk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=w6rz.net; spf=pass smtp.mailfrom=w6rz.net; dkim=pass (2048-bit key) header.d=w6rz.net header.i=@w6rz.net header.b=lZE1OKml; arc=none smtp.client-ip=35.89.44.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=w6rz.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=w6rz.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=w6rz.net header.i=@w6rz.net header.b="lZE1OKml" Received: from eig-obgw-6007b.ext.cloudfilter.net ([10.0.30.166]) by cmsmtp with ESMTPS id LNRcwecuNjw8YLQWewYKC1; Fri, 08 May 2026 19:06:16 +0000 Received: from box5620.bluehost.com ([162.241.219.59]) by cmsmtp with ESMTPS id LQWdw8PdxtuVJLQWdwtncX; Fri, 08 May 2026 19:06:16 +0000 X-Authority-Analysis: v=2.4 cv=BNWzrEQG c=1 sm=1 tr=0 ts=69fe3428 a=30941lsx5skRcbJ0JMGu9A==:117 a=30941lsx5skRcbJ0JMGu9A==:17 a=IkcTkHD0fZMA:10 a=NGcC8JguVDcA:10 a=7vwVE5O1G3EA:10 a=ag1SF4gXAAAA:8 a=sgGi2oMhMTPHD_uuIsQA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=Yupwre4RP9_Eg_Bd0iYG:22 a=L5EjiQpGQaFGZdqT14z7:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w6rz.net; s=default; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:From: References:Cc:To:Subject:MIME-Version:Date:Message-ID:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=tshay6nRwiV+vcSCbLh817UOpSD3/f9QDkM8OdCaNOU=; b=lZE1OKmlrWz5pGb8PhUN057Soe oBAsuMrEFnCoS7fKKJSzWyE1Ogh/FuKII46p0gXV408u0uROsz/87a0TPe9PZ3GjMgLhEYAh6Ub6O F1+mIIpBcrBrXqDuqt7+T/g3+Z7Fx1kP/tqBre9huOwpvSPgCoxMy7HR7zi2uKwxb7gUw1yWa4qVm MBrjwgReuao6DF3+nQY7TgQNya9Ug2rzGLCFEdRDkZLDwOXC4RTslYJphTavp+BZY2vFStdoSyf2m yoqPpmVwar04CxryfJIKAasIAnaMpwW7RFyqwPlCn4rwSoT/p4bfKBQOg6rqmdi74m5fjJYFCDlen E8m2AHlQ==; Received: from c-73-162-206-103.hsd1.ca.comcast.net ([73.162.206.103]:60558 helo=[10.0.1.180]) by box5620.bluehost.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.99.2) (envelope-from ) id 1wLQWc-00000001sxc-31Db; Fri, 08 May 2026 13:06:14 -0600 Message-ID: Date: Fri, 8 May 2026 12:06:10 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Linux 5.15.205 To: "gregkh@linuxfoundation.org" , Ben Hutchings Cc: Massimiliano Pellizzer , Dominik Grzegorzek , "torvalds@linux-foundation.org" , "lwn@lwn.net" , "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "akpm@linux-foundation.org" , "jslaby@suse.cz" References: <2026050835-appealing-stallion-a207@gregkh> <1b941a1353791ddd6fd75fb8e68b377367d689ff.camel@oracle.com> <2026050829-gladiator-displease-57af@gregkh> <2026050855-valley-slashed-c382@gregkh> <2026050815-length-yummy-f8b6@gregkh> <036ef29e143799f9117792463d640916490fa61a.camel@debian.org> <2026050840-washcloth-showdown-b66f@gregkh> Content-Language: en-US From: Ron Economos In-Reply-To: <2026050840-washcloth-showdown-b66f@gregkh> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box5620.bluehost.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - w6rz.net X-BWhitelist: no X-Source-IP: 73.162.206.103 X-Source-L: No X-Exim-ID: 1wLQWc-00000001sxc-31Db X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-162-206-103.hsd1.ca.comcast.net ([10.0.1.180]) [73.162.206.103]:60558 X-Source-Auth: re@w6rz.net X-Email-Count: 3 X-Org: HG=bhshared;ORG=bluehost; X-Source-Cap: d3NpeHJ6bmU7d3NpeHJ6bmU7Ym94NTYyMC5ibHVlaG9zdC5jb20= X-Local-Domain: yes X-CMAE-Envelope: MS4xfOzpin0MP+x9AefxtfOXTKviLH0SYs3v/ISioEAFZ1SmVj9gp9AF9MFZKUK8yGv/dkSgR1hsyKbwwB/h//jindiBf1KGXmiazrQJnSB0aRK23SNJdOJM y5G0/5S9+ZsorDtuWY22A5qUqYZ7MzDY4uWeNynlIGo077ZSNOnloKcpXVi32XYzYGhnHyzD30u3o8y1hwxIA42w+Tlq/k3UJiI= On 5/8/26 07:50, gregkh@linuxfoundation.org wrote: > On Fri, May 08, 2026 at 04:38:45PM +0200, Ben Hutchings wrote: >> On Fri, 2026-05-08 at 16:30 +0200, gregkh@linuxfoundation.org wrote: >>> On Fri, May 08, 2026 at 04:07:31PM +0200, Massimiliano Pellizzer wrote: >>>> On Fri, May 8, 2026 at 3:50 PM gregkh@linuxfoundation.org >>>> wrote: >>>>> On Fri, May 08, 2026 at 03:13:51PM +0200, Massimiliano Pellizzer wrote: >>>>>> On Fri, May 8, 2026 at 2:44 PM gregkh@linuxfoundation.org >>>>>> wrote: >>>>>>> On Fri, May 08, 2026 at 12:05:02PM +0000, Dominik Grzegorzek wrote: >>>>>>>> Hi, >>>>>>>> >>>>>>>> I may be mistaken, but I think there might be a small typo in this hunk in net/ipv4/ip_output.c: >>>>>>>> >>>>>>>> skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; >>>>>>>> >>>>>>>> Would this need to be: >>>>>>>> >>>>>>>> skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; >>>>>>>> >>>>>>>> My understanding is that SKBFL_SHARED_FRAG is a bit in skb_shared_info->flags, and skb_has_shared_frag() checks skb_shinfo(skb)->flags. >>>>>>> Adding Ben who did the 5.10 backport so he can comment on this. >>>>>>> >>>>>>> thanks, >>>>>>> >>>>>>> greg k-h >>>>>>> >>>>>> Hi, >>>>>> >>>>>> The new released kernel 5.15.205 is still vulnerable to CVE-2026-43284. >>>>>> >>>>>> ``` >>>>>> $ ./run.sh >>>>>> === Stage 1 — overwrite 'systemd-timesync' line (89 bytes) with >>>>>> 'sick::0:0::/:/bin/bash' >>>>>> === Stage 2 — verify >>>>>> sick::0:0:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:/:/bin/bash >>>>>> === Stage 3 — su - sick (empty password via PAM nullok) >>>>>> [i] state saved to /var/tmp/.cf2.state — run './run.sh --clean' to revert >>>>>> # uname -r >>>>>> 5.15.205 >>>>>> ``` >>>>>> >>>>> Does the patch below fix this up? >>>>> >>>>> thanks, >>>>> >>>>> greg k-h >>>>> >>>>> ------------------ >>>>> >>>>> >>>>> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c >>>>> index 68509e1f89b5..5d8f8a5901bc 100644 >>>>> --- a/net/ipv4/ip_output.c >>>>> +++ b/net/ipv4/ip_output.c >>>>> @@ -1443,7 +1443,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, >>>>> goto error; >>>>> } >>>>> >>>>> - skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; >>>>> + skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; >>>>> >>>>> if (skb->ip_summed == CHECKSUM_NONE) { >>>>> __wsum csum; >>>> Yes, this works. >>> Wait, is this also needed in the 6.1.y backport as well? >>> >>> Ben, I'm guessing you tested the 6.1.y backport, right? >> Yes, but on 6.1 the PoC never succeeded for me even without the patch. >> (On 5.10 and 6.12 it does.) So unfortunately that testing could not >> show whether my attempted fix was correct. >> >> Sorry for screwing this one up. > Not a problem, thanks for doing the backport at all! I'll go do a new > 6.1.y release now. > > Releases for everyone!!! > > thanks, > > greg k-h > Doesn't 5.10.255 need the flag fixup too?