From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 69D0D80266 for ; Mon, 31 Aug 2026 22:50:11 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 67VMmwev030927; Tue, 1 Sep 2026 01:48:59 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 67VMmwev030927 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="YgahBaFy" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 67VMmrdN030894 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 1 Sep 2026 01:48:53 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 67VMmrdN030894 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-47f6d70223dso2801825f8f.1 for ; Mon, 31 Aug 2026 15:48:53 -0700 (PDT) X-Gm-Message-State: AFuF++mY75UpHxkoK/MgPG0SG2T2TOOOoK78uSASisOTg+gCQVNcRPw7 BxbEC8MY50xGugLr3Oj32qOKUXY07KuDWyR6uwU8AZYDL2HuLXNSMbZps6IhMYyqd0DUPb0TuhC upjzfrOkDKT/GfMGyBpwUYXB08+WJC7eo9I0fcXzfmA/oClNeT9wSPg== X-Gm-Gg: AYBFou0DlhIPRnyMZ+oD+wdTMoAbRbcYZAgISRERN0po7G+LEygbY6JtZefYTd9fCf8 zNNNOyzK+OTbo+aoTGP11nuM+yB2bhYUDAzNcmw7RB5WJKB8aN3f0QA3DyMR21X8lXQBxun0jbi Y2kuoYs5ZrnXkpzUY3KUCmA1zVo4nCBaiSd7m86fZUsdp4poZCqccA9eulcaS0dKKFZbEIOJ/PU uilDTmaOdZebQ4s82o6eWXdc10zd15GZoTcXxqxxckrGSA7cgdLyO5MUI98VxElNzVlMGs2KKps e2nYX6WIupET7kCMM7xSkpqHoDMjw+RU3XfGEuOHQ7ffV4rovt1R4+l2LdFyfdRC83EwuWBTtz+ TSNdqwNhs+VlqcN73ZTJZHDCt X-Received: by 2002:adf:e009:0:20b0:47f:96e6:70a with SMTP id ffacd0b85a97d-48440f5c16cmr6218127f8f.0.1788216533308; Mon, 31 Aug 2026 15:48:53 -0700 (PDT) X-Received: by 2002:adf:e009:0:20b0:47f:96e6:70a with SMTP id ffacd0b85a97d-48440f5c16cmr6218087f8f.0.1788216532681; Mon, 31 Aug 2026 15:48:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788216532; cv=none; d=google.com; s=arc-20260327; b=R3plWvsAfQr2q6bOvBfkWgJvqXrphxulq6DnAvaQ1EF4J3n166n11wiWBD1UPN9Eok c7hjb/DpE6X9O48LinxJam/Fg09KIi1Ut8sxQL+tooFgCY/kGt2YBOBQAjPzgXKZKGwR I0XdML6aXQ8jsqSHx+lCAD2kcOn83h5podP0rYo+usMcTtnMe4Thg7cITkFOvKZlFU8h x2SiZzybecobdp2SaCngKna13psfaUdfAUTsYG2B7vjE5JtJSBh6ueSzSS6VDLCmLEIx 0U39iQWImuMWhnpLsb9Nm+yuBcG2H59A/o6w9A/wuTy3VufeHFpf3Z6E5rDMMcEa7Pkk 7HEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=FSoSpqgHRMBLazT8T4K9v1UpYmnMaP2+IefhAw7TDdM=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=W2OWFvLvO0TqePgPu2yQBM1nD1p+x2tGMm8chCZhtbh6aakxDjyaxcSKFHly7sQbHO gl7fOTwFLzsGGlYEKyZkgq6yhnURw+w1G/1NKratJC1LJUkjL8+IIPzKxlkacwvAeQDe IaWg5ovNG8rqlufDtBvmciJhHpoOjWbJ24BMKF4Xn+q8MhDhW4ojKf9Mdr7//kjBpNAM 92cywMPw2VZxXLDA80lqk42ogBds/uevROFofvEhibbnPaSH2P7XhKhpNL/7FuzVRL4G bprXettNKPR1lWfrmjZgtdj1u1Q543VFuEYtRxwyQTchJa79x2c53jmRs5pSr/5kcROl 0H4g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=YgahBaFy; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48442d37c2bsi650077f8f.44.2026.08.31.15.48.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 31 Aug 2026 15:48:52 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=YgahBaFy; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=FSoSpqgHRMBLazT8T4K9v1UpYmnMaP2+IefhAw7TDdM=; b=YgahBaFyQ27f HCcm1hu1YyWO2lmvxB3xwWb7180Gbz6G5ZzS/zKf7TZ59Dytc+JQ5HctayUkA4IOlwIVjI7uR8xHV HPg46wEaEPd9iwooJB4B+znapGa4hboxOKkL0ez6o1dscwcP+1K1ar+zEUrbZ4gixGKdVJGyt7kEa ml7wbEoIcBq9ekptk11rhOtvYOIm1kQ7QIzubQ8QpxSnH2lY8Iw3AjZhtCgG13k+dKy7EYtHcfN71 ciEhFmXKU+N3+TNa6zohFy6eSvKV3w62msvXDdeQe+Kzyy42OuyYVXIBFA7+ZGQ0+0pCjFYe48TfY kWB5ckDprE0VzNgs7gd9Iw==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1x1All-009jQI-1z; Tue, 01 Sep 2026 00:48:43 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Tue, 1 Sep 2026 01:48:19 +0300 Message-ID: <20260831224850.1642265-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz10 1/7] ms/vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Eric Dumazet skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Eric Dumazet Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20260525203642.2389723-1-edumazet@google.com Signed-off-by: Jakub Kicinski (cherry picked from commit 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf) https://virtuozzo.atlassian.net/browse/VSTOR-139651 Feature: fix ms/net Signed-off-by: Eva Kurchatova --- drivers/net/vxlan/vxlan_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 7c9d2450209a..700bee7e7733 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -2554,7 +2554,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, goto out_unlock; } - tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb); ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), vni, md, flags, udp_sum); @@ -2623,7 +2623,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, goto out_unlock; } - tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb); ttl = ttl ? : ip6_dst_hoplimit(ndst); skb_scrub_packet(skb, xnet); err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel