diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-05-23 19:54:51 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-05-23 19:54:51 +0200 |
| commit | dc194b8f6275f55d812e316dcb55cd8f57056cf1 (patch) | |
| tree | 94e43dd5a2236d1a2af479525432bca7de648bf2 /scripts | |
| parent | 440a78d5e423e444c29f58cd5a377cff859863eb (diff) | |
| download | vyos-build-dc194b8f6275f55d812e316dcb55cd8f57056cf1.tar.gz vyos-build-dc194b8f6275f55d812e316dcb55cd8f57056cf1.zip | |
Kernel: T8919: Update Linux Kernel to 6.18.33
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch | 53 |
1 files changed, 0 insertions, 53 deletions
diff --git a/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch b/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch deleted file mode 100644 index b2a4f9be..00000000 --- a/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch +++ /dev/null @@ -1,53 +0,0 @@ -Message-ID: <20260513041635.1289541-1-vakzz@zellic.io> -Date: Wed, 13 May 2026 04:16:35 +0000 -From: William Bowling <vakzz@...lic.io> -To: netdev@...r.kernel.org -Cc: "David S . Miller" <davem@...emloft.net>, - Eric Dumazet <edumazet@...gle.com>, - Jakub Kicinski <kuba@...nel.org>, - Paolo Abeni <pabeni@...hat.com>, - Steffen Klassert <steffen.klassert@...unet.com>, - Herbert Xu <herbert@...dor.apana.org.au>, - David Ahern <dsahern@...nel.org>, - William Bowling <vakzz@...lic.io> -Subject: [PATCH] net: skbuff: preserve shared-frag marker during coalescing - -skb_try_coalesce() can attach paged frags from @from to @to. If @from -has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same -externally-owned or page-cache-backed frags, but the shared-frag marker -is currently lost. - -That breaks the invariant relied on by later in-place writers. In -particular, ESP input checks skb_has_shared_frag() before deciding -whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP -receive coalescing has moved shared frags into an unmarked skb, ESP can -see skb_has_shared_frag() as false and decrypt in place over page-cache -backed frags. - -Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged -frags. The tailroom copy path does not need the marker because it copies -bytes into @to's linear data rather than transferring frag descriptors. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Signed-off-by: William Bowling <vakzz@...lic.io> ---- - net/core/skbuff.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a4695882d1c4..3e8f0b8226ca 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -6149,6 +6149,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; --- -2.39.5 - |
