[Devel] [PATCH vz7] ms/netfilter: bridge: make ebt_snat ARP rewrite writable

[Devel] [PATCH vz7] ms/netfilter: bridge: make ebt_snat ARP rewrite writable

[Konstantin Khorenko]

From: Yiming Qian <yimingqian591@gmail.com>

The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0).  This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.

However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:

        skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)

skb_header_pointer() only safely reads the ARP header; it does not make
the later sender hardware address range writable.  If that range is
still held in a nonlinear skb fragment backed by a splice-imported file
page, skb_store_bits() maps the frag page and copies the new MAC address
directly into it.

Ensure the ARP SHA range is writable before reading the ARP header and
before calling skb_store_bits().

Fixes: 63137bc5882a ("netfilter: ebtables: Fixes dropping of small packets in bridge nat")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
(cherry picked from commit 67ba971ae02514d85818fe0c32549ab4bfa3bf49)

Backport notes:
 - applies unchanged.

63137bc5882a from Fixes: is not here. It undid the ebt_snat_tg() part
of ms commit c1a831167901 ("netfilter: bridge: convert
skb_make_writable to skb_ensure_writable") in v5.3, which this tree
never had, so the function here already has skb_make_writable(skb, 0)
and the unguarded ARP sender hardware address write.

skb_ensure_writable() exists here, while the rest of the file still
uses skb_make_writable(). Both pull the requested range into the linear
area, so the ARP SHA write goes to the skb head and not to a shared
fragment page. RHEL7 kernel-3.10.0-1160.169.1.el7 carries the same
change.

CVE-2026-53266
https://virtuozzo.atlassian.net/browse/VSTOR-154194

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
CVE-2026-53266 fix for the vz7 kernel.

https://virtuozzo.atlassian.net/browse/VSTOR-154194

Assisted-by: LLM
---
 net/bridge/netfilter/ebt_snat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index e56ccd060d268..266345ad45c89 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -30,6 +30,9 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		const struct arphdr *ap;
 		struct arphdr _ah;
 
+		if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN))
+			return EBT_DROP;
+
 		ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
 		if (ap == NULL)
 			return EBT_DROP;

---
base-commit: 78c10c447efc7633a8e4260fe7dc33e1cb4bb4d2
change-id: 20261109-b4-prep-khorenko-vstor-154194-ebt_snat-arp-writable-d0dfafef1cd3

Best regards,
--  
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH vz7] ms/netfilter: bridge: make ebt_snat ARP rewrite writable

[no-reply]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] netfilter: ebt_snat backport notes misdescribe the tree (skb_make_writable)
--

commit 104d376b9788e858d4ac4df6973edf7b2248c98a
Author: Yiming Qian <yimingqian591@gmail.com>

ms/netfilter: bridge: make ebt_snat ARP rewrite writable

This commit adds a skb_ensure_writable() call in ebt_snat_tg() so that the
ARP sender hardware address range is writable before skb_header_pointer()
and skb_store_bits() are called. It is a backport of upstream commit
67ba971ae025. The code change looks correct. My only comment is on the
backport notes in the commit message.

> diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
> index 7dfbcdfc30e5..c9e229af0366 100644
> --- a/net/bridge/netfilter/ebt_snat.c
> +++ b/net/bridge/netfilter/ebt_snat.c

[ ... ]

> @@ -31,6 +31,9 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par)
>  		const struct arphdr *ap;
>  		struct arphdr _ah;
>  
> +		if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN))
> +			return EBT_DROP;
> +
>  		ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
>  		if (ap == NULL)
>  			return EBT_DROP;

[Severity: Low]
This isn't a bug in the code, but the backport notes in the commit message
don't match the tree this patch applies to.

The notes say "the function here already has skb_make_writable(skb, 0)" and
"the rest of the file still uses skb_make_writable()". They also say that
63137bc5882a and the v5.3 conversion c1a831167901 are not present in this
tree.

In the tree as it stands with this patch applied, ebt_snat_tg() already
begins with:

    if (skb_ensure_writable(skb, 0))
        return EBT_DROP;

The sibling targets ebt_dnat_tg() and ebt_redirect_tg() also call
skb_ensure_writable(), and I found no skb_make_writable() left in
net/bridge/netfilter/. The patch only adds three lines, so the baseline
already had the skb_ensure_writable(skb, 0) call.

These notes look like they were written for the vz7 (3.10) version of the
patch. The statements "applies unchanged" and "63137bc5882a from Fixes: is
not here" may need to be corrected for this branch.

The mention of RHEL7 carrying the same change may also not belong in the
notes for this branch.

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261109-b4-prep-khorenko-vstor-154194-ebt_snat-arp-writable-v1-1-67df711251c0@virtuozzo.com?part=1

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel