Please backport: DSA taggers OOB read on PACKET_QDISC_BYPASS TX

Please backport: DSA taggers OOB read on PACKET_QDISC_BYPASS TX

[Doruk Tan Ozturk]

Please backport the following mainline commits to the stable trees.

Reason: the ocelot, ksz and sja1105 DSA taggers dereference
eth_hdr(skb)/skb_mac_header(skb) on their TX paths. skb->mac_header is
not set on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path
(packet_direct_xmit() -> netdev_start_xmit(), which bypasses the
dev_hard_start_xmit() reset from 6d1ccff62780), so eth_hdr(skb) resolves
~64 KB out of bounds -> out-of-bounds read. The fixes below make these
taggers read the header from skb->data instead. Reproducible with an
unmodified CONFIG_NET_DSA_LOOP=y kernel by sending on a raw packet
socket with PACKET_QDISC_BYPASS set.

These commits went into v6.4 without a Cc: stable tag because they were
made as preparation for reverting 6d1ccff62780 and the bug was assumed
to be future-only; it is not -- the bypass path was always unaffected by
that reset. 6.6.y and 6.12.y already carry them.

Prerequisite (helper, not a fix on its own; needed or the ocelot and
sja1105 fixes will not build on pre-v6.4 trees):

  1f5020acb33f ("net: vlan: introduce skb_vlan_eth_hdr()")

Fixes, in mainline order:

  eabb1494c9f2 ("net: dsa: tag_ocelot: do not rely on skb_mac_header() for VLAN xmit")
  499b2491d550 ("net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths")
  f9346f00b5af ("net: dsa: tag_sja1105: don't rely on skb_mac_header() in TX paths")
  0bcf2e4aca6c ("net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX")

Not all fixes apply to all trees (the vulnerable code was introduced at
different times). Per tree:

  6.1.y:  1f5020acb33f, eabb1494c9f2, 499b2491d550, f9346f00b5af, 0bcf2e4aca6c
  5.15.y: 1f5020acb33f, 499b2491d550, f9346f00b5af
          (tag_ocelot has no ocelot_xmit_get_vlan_info() before v5.16)
  5.10.y: 499b2491d550
          (sja1105_pvid_tag_control_pkt() is v5.15+; ocelot is v5.16+;
           skb_eth_hdr() already present, so no prerequisite needed)

Ordering: apply 1f5020acb33f before eabb1494c9f2/f9346f00b5af, and
eabb1494c9f2 before 0bcf2e4aca6c.

5.4.y is EOL and also lacks skb_eth_hdr(); not requested.

Thanks,
Doruk Ozturk

Re: Please backport: DSA taggers OOB read on PACKET_QDISC_BYPASS TX

[Sasha Levin]

On Tue, Jul 14, 2026 at 06:46:33PM +0200, Doruk Tan Ozturk wrote:
>   eabb1494c9f2 ("net: dsa: tag_ocelot: do not rely on skb_mac_header() for VLAN xmit")
>   499b2491d550 ("net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths")
>   f9346f00b5af ("net: dsa: tag_sja1105: don't rely on skb_mac_header() in TX paths")
>   0bcf2e4aca6c ("net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX")

I've queued the tag_ksz fix (499b2491d550) for 6.1 and 5.15; 6.6 and
newer already have it.

I'm holding off on the ocelot and sja1105 commits (and their
skb_vlan_eth_hdr() prerequisite), as well as on 5.10 entirely - the
backports there diverge more from upstream than I'm comfortable
carrying without more soak time.

-- 
Thanks,
Sasha