From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE14035292A; Tue, 16 Jun 2026 18:17:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781633840; cv=none; b=SJKlyHO8/9swAYNRiigtFaz4SpZBSesFUoe/JKjAxYoRkhRmq8Ue7+95j9aV364tZWB8RwId/yrjTh3n2C8XE2M/nc6obx0j8tEj8aMVYCaLMXQjN4sUzPY8Nu1AmPTay1BIWs+k5ktJfmla7c/Uo7wbyNVbamqGd9VelZSiD94= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781633840; c=relaxed/simple; bh=5fMM7O8gE7eFADKRMovCkxsDQHXkd6TvQloa8A17TAo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I5N0ES3ZfFViKf9mZlBtW0TvsBdfHZdg1jON/yXNNxyPrB3GmlvAHAFJC9OAnN916iSaoZOPXCUUZKu+bLxyUZw6Kyi4/IwLm6GICYwf3ap7KyYXv4kXc0B/WHjAefunhGeHIbYUKx+b4CQaQyhap8xt+ABHY2Z64lLoPe4gVio= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wc9sQl0D; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="wc9sQl0D" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2F321F000E9; Tue, 16 Jun 2026 18:17:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781633839; bh=HM6zYNYuxRMlEEwGEndcYp2hYwtDentMAdBZBYMYcNQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wc9sQl0Dozd7/j16/HWHhfWUTiyMlvk5UjOyjaD2MPViJYkkPHSsatCTQ+QV0ViJQ AoIGsNHTlLS/2Wl6tBWJw9qfvyMY9XQfUWy9Cxw5MNbl8HPuS3oIeF/S65KNv52G5Q ofqvgDKIlrCwmrh2OiwFmgnYAMzNn1L/cz/czWKk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yiming Qian , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15 154/411] netfilter: bridge: make ebt_snat ARP rewrite writable Date: Tue, 16 Jun 2026 20:26:32 +0530 Message-ID: <20260616145108.634064441@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145100.376842714@linuxfoundation.org> References: <20260616145100.376842714@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yiming Qian [ Upstream commit 67ba971ae02514d85818fe0c32549ab4bfa3bf49 ] The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). Fixes: 63137bc5882a ("netfilter: ebtables: Fixes dropping of small packets in bridge nat") Reported-by: Yiming Qian Signed-off-by: Yiming Qian Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/bridge/netfilter/ebt_snat.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c index 7dfbcdfc30e5d2..c9e229af0366b8 100644 --- a/net/bridge/netfilter/ebt_snat.c +++ b/net/bridge/netfilter/ebt_snat.c @@ -31,6 +31,9 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par) const struct arphdr *ap; struct arphdr _ah; + if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN)) + return EBT_DROP; + ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah); if (ap == NULL) return EBT_DROP; -- 2.53.0