From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C7354D98F7 for ; Tue, 14 Jul 2026 16:46:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784047598; cv=none; b=L83+OWiCARDcbP0hGxa+sLn71hfp8V4HNx0QZ+3u0zI3wYy/x/ltFqJElYIQV7YQ5qzC1kgFK2c5M/yUfd1pkESdV12d/ZA+cDlOlmbTJ/Gw0NXNkCYeJki0Gj4xH0jHcSxdTha8kiNBZ32dkvt1Y1Wvo5uTv7zogdTah5POcPw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784047598; c=relaxed/simple; bh=9iodVMrU+2GAF2BdS6r4I7mPchCfTnRiHaGN1DpNBHE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=shRM7riVS1jCjBFSv75EEF8ZfSK9Adj3OXASQR2WMuIYSw9jfEDTh8wKWGoddJjfYm5XM9yr1Dqe/+HXDL5V1TKMVWzQrNIWA/TFRneH1BEogfZM+LYiuzjCvvIgphRD1ze1CCyTudJZPYlGHTAdQvPA9JKTTavoLvFsoLHUf2c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=encKXvoW; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="encKXvoW" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-475cb71a4ebso4315166f8f.0 for ; Tue, 14 Jul 2026 09:46:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1784047596; x=1784652396; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xA34URPmvLevJFaYVe08J7EpsJU8i+fALDat5zmBi3g=; b=encKXvoW02r8DklJ2kIbfxCvf+XSZ4XX93lJ+91p9CLzAhZc0nf2oNxfRoNmrk1lYe AzcDgQ6kOEU2YgRvZf2dz+pCJd6UDqlfx+4uwFzPPXoulFLYcDzob7EpTUc1QTPgN3h1 fXluyw05AuWLt7/v3ym37dkQiVoDREZyCfCl1S/4G2IPAXel9I75g9J+pb6oTFjsVB2T frhKYBMXlg1VVviLk/1HLWBR3TbLhmfEuP2l8oTbYoDKEkKaKoJGcU8gkW6/sWtB3T6c jBbmpFdCHaRbo84Jdc0xw0thhfSG1KWCPki0gaHhXv7W2bW14/VnU6Gl9U3kcx8S/vMy 7Zzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784047596; x=1784652396; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xA34URPmvLevJFaYVe08J7EpsJU8i+fALDat5zmBi3g=; b=LKYG8Dfcw1N0eVmTMR3OrNkj5U3aOgXX1Q+Im7fbLlcSTLEpM396B81PV9ij47Aa3x ABc7kw02dUgZMzADcJkZUZvlgzBOuxkQfMf5nuzldllZ4KVDveflAnPSTMuy2g/xmcfg rLxcwb1wllK9blefhCg2NHm+7SvghL2YwaCpAZwQ26465zewaKUKifGytJ/Iw+ymmCc5 Zo6FSps9dctHa0uJPq8LfZdGMrn9DRyMoPTHUGntEtWv7Ls+GBLeXwfudeefwVS2eFRh 9bPjyaVGNdTaG6tSIyOJXz35xhMq+ZaMYN8FnluC+1zNzbpnw4dVy4gydRwhglmSuFIK bNng== X-Forwarded-Encrypted: i=1; AHgh+RqEmvkUUCeJ+FjM49SOfBX212UBurYDlnt7XPlGhqas4HtHfguHkVY2KGzhvu0tW2whaGBGxD0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw/Im0IHo6yvwCYxKvjStBk8MF/pW/mw5b2gp9ceO8UdE0ugA7f oyUAqPjR+eyVXAAQmHBYt2jNvbE+VU3nQvTXiS926C3ztHeo6oSgCQcQlGyYhMB+iiSU X-Gm-Gg: AfdE7ckeNe7syk5nT5nzzVMIhF6YuuVHbPVGM1mYrxgwJICJcTQE3soCrGPRoJxqR1z tGqq8pOVwbYHPChTj9yRxJfW19jfOGM5YsB5tnQX2bLSI5K4kwJpoQfvY1igY8rs0jKT4zkVbYn h8jdn2/6E8FmNfbpSAPeb8imyrG34TGIQqS7w9PIBzArJ83dK+/FNEDCnBk8OO4fQr2CWmIO9TK D8JG8le/W2n2NU6QW1ggevoYEV8Khhfvy1VWW2CwHXT0K2jJfYCkkTX33pKW+GW4mXfFdpamj5u TcACY7LNpS0nOt+RI3p+MqxnnKsyqrbfbODQ/7Gs97f3ZNYpJ6EFqyoFJFceTc9uW6RmLJBvrXM yfAe6Q7hKDgye5VI1k4Dqz17czz+IkJFI+Zf0fnyhHX5rhjlQdJcx4LMJffO3B8VcgTTLZgZraX cHz6kHtE7U8/13eAcFrr5akIuc7M8hlBwGFnKQAJvvXaXaRRw/3lKT/o6cgeUJ8Cg3+ZaguPcLZ F3dFN7bcCKwWOavIGjzxjbc4y3U5yCfhC0= X-Received: by 2002:a05:6000:4615:b0:46d:d6e0:9cc6 with SMTP id ffacd0b85a97d-47f2dcf556emr15992661f8f.44.1784047595602; Tue, 14 Jul 2026 09:46:35 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.218.188]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f4634e0d9sm9739781f8f.2.2026.07.14.09.46.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 14 Jul 2026 09:46:35 -0700 (PDT) From: Doruk Tan Ozturk To: stable@vger.kernel.org Cc: olteanv@gmail.com, andrew@lunn.ch, f.fainelli@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org Subject: Please backport: DSA taggers OOB read on PACKET_QDISC_BYPASS TX Date: Tue, 14 Jul 2026 18:46:33 +0200 Message-ID: <20260714164633.75135-1-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Please backport the following mainline commits to the stable trees. Reason: the ocelot, ksz and sja1105 DSA taggers dereference eth_hdr(skb)/skb_mac_header(skb) on their TX paths. skb->mac_header is not set on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path (packet_direct_xmit() -> netdev_start_xmit(), which bypasses the dev_hard_start_xmit() reset from 6d1ccff62780), so eth_hdr(skb) resolves ~64 KB out of bounds -> out-of-bounds read. The fixes below make these taggers read the header from skb->data instead. Reproducible with an unmodified CONFIG_NET_DSA_LOOP=y kernel by sending on a raw packet socket with PACKET_QDISC_BYPASS set. These commits went into v6.4 without a Cc: stable tag because they were made as preparation for reverting 6d1ccff62780 and the bug was assumed to be future-only; it is not -- the bypass path was always unaffected by that reset. 6.6.y and 6.12.y already carry them. Prerequisite (helper, not a fix on its own; needed or the ocelot and sja1105 fixes will not build on pre-v6.4 trees): 1f5020acb33f ("net: vlan: introduce skb_vlan_eth_hdr()") Fixes, in mainline order: eabb1494c9f2 ("net: dsa: tag_ocelot: do not rely on skb_mac_header() for VLAN xmit") 499b2491d550 ("net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths") f9346f00b5af ("net: dsa: tag_sja1105: don't rely on skb_mac_header() in TX paths") 0bcf2e4aca6c ("net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX") Not all fixes apply to all trees (the vulnerable code was introduced at different times). Per tree: 6.1.y: 1f5020acb33f, eabb1494c9f2, 499b2491d550, f9346f00b5af, 0bcf2e4aca6c 5.15.y: 1f5020acb33f, 499b2491d550, f9346f00b5af (tag_ocelot has no ocelot_xmit_get_vlan_info() before v5.16) 5.10.y: 499b2491d550 (sja1105_pvid_tag_control_pkt() is v5.15+; ocelot is v5.16+; skb_eth_hdr() already present, so no prerequisite needed) Ordering: apply 1f5020acb33f before eabb1494c9f2/f9346f00b5af, and eabb1494c9f2 before 0bcf2e4aca6c. 5.4.y is EOL and also lacks skb_eth_hdr(); not requested. Thanks, Doruk Ozturk