[PATCH 5.10/6.1] ipvs: reload ip header after head reallocation
Denis Arefev <[email protected]>
| Newsgroups | gmane.linux.kernel.stable,gmane.linux.network,gmane.comp.linux.lvs.devel,gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Florian Westphal <[email protected]> commit a2f57827bf7c695b8c72dc4511cae8e86582369d upstream. __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head. Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl") Cc: [email protected] Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Julian Anastasov <[email protected]> Signed-off-by: Florian Westphal <[email protected]> [Denis Arefev: adapted for 5.10/6.1: keep EnterFunction/LeaveFunction instrumentation] Signed-off-by: Denis Arefev <[email protected]> --- Backport fix for CVE-2026-68476 Link: https://nvd.nist.gov/vuln/detail/CVE-2026-68476 --- net/netfilter/ipvs/ip_vs_xmit.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c index 9e199f00eea7..29ca141e3795 100644 --- a/net/netfilter/ipvs/ip_vs_xmit.c +++ b/net/netfilter/ipvs/ip_vs_xmit.c @@ -718,15 +718,13 @@ int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp, struct ip_vs_iphdr *ipvsh) { - struct iphdr *iph = ip_hdr(skb); - EnterFunction(10); - if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr, - IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0) + if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, ip_hdr(skb)->daddr, + IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0) goto tx_error; - ip_send_check(iph); + ip_send_check(ip_hdr(skb)); /* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df = 1; -- 2.43.0