In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vlan: fix skb_under_panic and races when toggling HW VLAN offload<\/p>\n
Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
\nNETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
\nwhich dynamically changed vlandev->hard_header_len.<\/p>\n
This causes two issues:
\n1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
\n read dev->hard_header_len without holding RTNL lock. Mutating
\n hard_header_len dynamically under RTNL creates a data race where upper
\n layers reserve insufficient headroom based on a stale hard_header_len,
\n resulting in skb_under_panic when vlan_dev_hard_header() is called.
\n2. In addition, vlan_transfer_features() updated hard_header_len without
\n updating header_ops, causing a mismatch between allocated headroom
\n and header creation.<\/p>\n
Always setting dev->hard_header_len = real_dev->hard_header_len and
\ndev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
\nensures:
\n– dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
\n eliminating all dynamic runtime updates and data races on hard_header_len.
\n– Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
\n sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
\n real_dev->needed_headroom + VLAN_HLEN).
\n– vlandev inherits real_dev->needed_tailroom so underlying trailer\/padding\/ICV
\n requirements are honored.
\n– AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
\n real_dev->hard_header_len.
\n– vlan_header_ops is used unconditionally.<\/p>\n
Note to stable teams: Make sure to backport these commits:<\/p>\n
e16e960d55a4 (“ipvlan: inherit needed_headroom and needed_tailroom from phy_dev”)
\ncef51860becd (“macvlan: inherit needed_headroom and needed_tailroom from lowerdev”)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vlan: fix skb_under_panic and races when toggling HW VLAN offload<\/p>\n
Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
\nNE<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20408","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}