From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 08E4781377 for ; Mon, 9 Nov 2026 18:37:08 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9IZpQh002615; Mon, 9 Nov 2026 21:35:51 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9IZpQh002615 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="dsWEq1cs" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9IZn47002611 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 21:35:49 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9IZn47002611 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48e0389d6f9so879538f8f.1 for ; Mon, 09 Nov 2026 10:35:49 -0800 (PST) X-Gm-Message-State: APuU4Z+LHqQL0Mjw3UsvstE79249Zi1zMoA5zoisXbW8sUy/XEaAEGaU aHT49u2+2b441NHwRo2iBdP4AbICQu1BnbvDQFEbvsD5PwboHJk164eIqI1+bLmzLqx2ldMjiLp ppCvjsOWiyQ0sT5e2t50fwYHrj2NOeESqw//0u9A8dBnVFa+aq3s3Cg== X-Gm-Gg: AYBFou2K8oPRbjKbBg9hxcSAWbf8L4cXfAV5lJZE59FzO2AfCHobTq+HoNwv/scM48a 8PMbykPrOoLQcW1UtXVYdy79oAUkDREQK356LRRFdrCLc8s5xq7bHIEaRxhIBnTl/CKpvY0ZCgD Noj+bQPAjE/cVhPxVrCPvjJLbAEWTgaAkcMBs4rUH/OceiBC1Eezw3X25CfVcm5B28T15Mmbae4 vVULOGNado8d9Wzq9WBB3pupWy4E4M/3TTomgRYTLmgxFUlkAI7EBWvOQapjTulSwPvaNqsaE51 Z5KRW9DKUN9eRIJzsLFrmdrvQ+qo/4mLUjG7INYufRLoSvTD82jdPCQOyq+FOsJaenCASEVYeKx cvGR2WdsAtou8Q8md X-Received: by 2002:a05:6000:1a8a:b0:492:9630:6a71 with SMTP id ffacd0b85a97d-4982c79917amr699939f8f.1.1794249348978; Mon, 09 Nov 2026 10:35:48 -0800 (PST) X-Received: by 2002:a05:6000:1a8a:b0:492:9630:6a71 with SMTP id ffacd0b85a97d-4982c79917amr699892f8f.1.1794249348498; Mon, 09 Nov 2026 10:35:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794249348; cv=none; d=google.com; s=arc-20260327; b=eINCR57QUP+pm+yG78PyeEYbQPFq1OiQWT7sQJGNOb0uslhqj0RHSSHIY+H5FCi0ZS aF74WpaN3JWeV5B9rF5GN9zJkWQu0+23plkbq/zVpTkQlY/dB/Yf4cf5bbZyS4yjYI9n 63s5UNr6DBBxJuz5eDhuIA9wYkGXVCddTS8uPDKQL5niCEBJqycaaUSl4k1q1bKHpSEN 8ILd9h8p8GAc9Ks9Mo4MeWldvLVgyH19SG6wtqSCWH4abrtk2YEMRPKr/Gas7N6QrsQV sDBLpzfomZGEDWk8I/KNCUJQN6gzg6bSBYY1xzQUNiI2EQe2/cXyGw5sacZ3D3+OPDKs f9mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=CBALon65WMLcJdTp5U1rm5PFP/baaUKRL93R8LT0MTY=; fh=26FXTO6eY/S3gvyMXNKNKTFHQ0lD1bPkQ8wRpe0tMZI=; b=lsyQrxIGpLhJchMXS7Fc6zaK91wX77YZQbsbkciagFjVwYywQBLLq5Frk3dKmKRonI 1ccWdzTNIDOUb18i1MG4x1JL+Q0gNvt8GT1ckRbmZNAHF2IKx7Gvgd9vQNG8u+wDIHez g/kz1/Nj+451oxI3gG4t26CUm54s1hYIEVyRWKaDe8YaBIip4mP6zO6xVIuWpl2cTmzu W+icowavf2o9KhSqzqfJvfHspxAa7G6FWHMVpP6S572h+vB2artvxZPGg3wOUR+SB7hO 5ltkCWFjwtM9Tg6o08idhrZ0lMqN20bk+lcSEH7VICn5nBxQYVqmpDAw1Ac8trI9CrMB ZnVA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=dsWEq1cs; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4983752351asi396876f8f.358.2026.11.09.10.35.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 10:35:48 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=dsWEq1cs; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=CBALon65WMLcJdTp5U1rm5PFP/baaUKRL93R8LT0MTY=; b=dsWEq1csCbwNCdXx6yB zx/AuFeRl0lqLgDgiTwCuOghe2IkJhj0K6nmfq6kJzh8kuush3eiBhiYcb0k6vFZmgMDxfiCib07H fowsHSXgs9fTN0XP6D9QQW7faq1E4GNLYG+HOOJkyzMFVgDSPX+dbxVVOtfdBU43OHPE4PeKRm1Kn RJIH0EO7Plm1lHmoZQFw2UzUY5cVR9QV9ZxbUZiABgyr6nqTf6p3FLdBKbpt78AJtFX3M0UV4xPi2 vf0JAcV9wm2oD+9RLS+kGUPk45bx2hQA7sU8YP6RaRBpnHUT6q3Fg5gK3GN9w03REbK9vQ+qWuIUK Khqqmku1GSxmtuA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xQU9X-00B863-17; Mon, 09 Nov 2026 19:35:39 +0100 From: Konstantin Khorenko Date: Mon, 09 Nov 2026 19:35:38 +0100 MIME-Version: 1.0 Message-Id: <20261109-b4-prep-khorenko-vstor-154194-ebt_snat-arp-writable-v1-1-67df711251c0@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIAHkS8moC/yWNyw7CIBAAf6XZs5tARU39FWMMj8ViDZAFq7Hpv 4t6nDnMLFCIAxU4dgswzaGEFBvITQd21PFKGFxj6EW/l1IMaBRmpozTmJjilHAuNTHKnZKDQjL 1UqKuqDnjk0PV5k7ohPPak5fWbaGVW8CH1+96gvl9gPNfloe5ka3fH6zrB46UJEqcAAAA X-Change-ID: 20261109-b4-prep-khorenko-vstor-154194-ebt_snat-arp-writable-d0dfafef1cd3 To: Konstantin Khorenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3209; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=DbQAY7fFNoDfkVwgmfVrhhapZslfzlz4Wp0TqQRe69U=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq8hKDNNWRT3MbrpLI3CyKhvR4m3OgR1EhdzDRX XI8HtcD7+GJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCavISgwAKCRBRlgpH+WFc KkzyD/wLN7gsvHOsyCQBLyDuqnkX3EDLBgwDoLszPoECcskLe5q28JHsu37ykH/ieOKcUpssa0h DRh3HceX77VLk0Xy99QWE7j/lciyx5SW8gYoRel5HjhKPrGR4Lfi8URfkn2aC4yDxtOjmRePjlD 92eczxEcbCvyUSeMNdOfNVDbxLvdN/L7G5f3zz7Vipidj7YGUPr/tZILiiIHucNzygwmzWF2Xtm 2p85JAK2ztYX5LBDKfL85rx/5QzXDPxqgRx5q7LnQtPhCsHoue2oU4P/uYVArm6weyCkcFgIhYr 0i+mVNrXgWFujKVSA+QdgMv16wjd+35tgvq5L5y88qvsUqQMUPMJEramO8G2d7CnUjy1uykHQwJ DepyajcPcLM2iTqkox77uBjc9hFesaqept/Djdjnqs5zyG9PMbCS1DTGnbZEkunkfrs3cI7ns+M BvNJiuArL1TklrjWBEeZfieatDhDMmriAMb+fYVh7zExR3cBsys76VvjaPmOzwHXQwRj5x7tBFN zpvZItg+11r8Opr1/AyGUnp1AE+pTctPE2wwOWP/RQVs8U0a+EsIp66yLJ6Y5jGoanwLrpsDtsZ Lo+xBjJW584sepqnpYFq4VAk4QnYKmv8zoxX6v9F1xtEGGmq958y84UCKga3w4QJVWMbTg61DjW uYRgP+UN8Z905lg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz7] ms/netfilter: bridge: make ebt_snat ARP rewrite writable X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Yiming Qian The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). Fixes: 63137bc5882a ("netfilter: ebtables: Fixes dropping of small packets in bridge nat") Reported-by: Yiming Qian Signed-off-by: Yiming Qian Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 67ba971ae02514d85818fe0c32549ab4bfa3bf49) Backport notes: - applies unchanged. 63137bc5882a from Fixes: is not here. It undid the ebt_snat_tg() part of ms commit c1a831167901 ("netfilter: bridge: convert skb_make_writable to skb_ensure_writable") in v5.3, which this tree never had, so the function here already has skb_make_writable(skb, 0) and the unguarded ARP sender hardware address write. skb_ensure_writable() exists here, while the rest of the file still uses skb_make_writable(). Both pull the requested range into the linear area, so the ARP SHA write goes to the skb head and not to a shared fragment page. RHEL7 kernel-3.10.0-1160.169.1.el7 carries the same change. CVE-2026-53266 https://virtuozzo.atlassian.net/browse/VSTOR-154194 Signed-off-by: Konstantin Khorenko --- CVE-2026-53266 fix for the vz7 kernel. https://virtuozzo.atlassian.net/browse/VSTOR-154194 Assisted-by: LLM --- net/bridge/netfilter/ebt_snat.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c index e56ccd060d268..266345ad45c89 100644 --- a/net/bridge/netfilter/ebt_snat.c +++ b/net/bridge/netfilter/ebt_snat.c @@ -30,6 +30,9 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par) const struct arphdr *ap; struct arphdr _ah; + if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN)) + return EBT_DROP; + ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah); if (ap == NULL) return EBT_DROP; --- base-commit: 78c10c447efc7633a8e4260fe7dc33e1cb4bb4d2 change-id: 20261109-b4-prep-khorenko-vstor-154194-ebt_snat-arp-writable-d0dfafef1cd3 Best regards, -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel