Skip to content

Patch kernel: backport ipv6 fraggap OOB-write fix (torvalds/linux@736b380e) #17848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
omkhar wants to merge 1 commit into
base: 3.0-dev
Choose a base branch
from
Open

Patch kernel: backport ipv6 fraggap OOB-write fix (torvalds/linux@736b380e) #17848

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-64k-signed/kernel-64k-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-64k-signed-%{buildarch}
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -105,6 +105,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%exclude /module_info.ld

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Release bump to stay in lockstep with the kernel spec entanglement group for the ipv6 fraggap fix (torvalds/linux@736b380e28d0).

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-signed/kernel-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-signed-%{buildarch}
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -145,6 +145,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%exclude /module_info.ld

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Release bump to stay in lockstep with the kernel spec entanglement group for the ipv6 fraggap fix (torvalds/linux@736b380e28d0).

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
5 changes: 4 additions & 1 deletion SPECS-SIGNED/kernel-uki-signed/kernel-uki-signed.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
Summary: Signed Unified Kernel Image for %{buildarch} systems
Name: kernel-uki-signed-%{buildarch}
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -68,6 +68,9 @@ popd
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Release bump to stay in lockstep with the kernel spec entanglement group for the ipv6 fraggap fix (torvalds/linux@736b380e28d0).

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
79 changes: 79 additions & 0 deletions SPECS/kernel-64k/0001-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
From 736b380e28d0480c7bc3e022f1950f31fe53a7c5 Mon Sep 17 00:00:00 2001
From: Wongi Lee <qw3rtyp0@gmail.com>
Date: Tue, 16 Jun 2026 22:46:17 +0900
Subject: ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as

alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.

The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc")
Signed-off-by: Jungwoo Lee <jwlee2217@gmail.com>
Signed-off-by: Wongi Lee <qw3rtyp0@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
net/ipv6/ip6_output.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9f1e0e4f74641..368e4fa3b43ca 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1667,8 +1667,8 @@ alloc_new_skb:
!(rt->dst.dev->features & NETIF_F_SG)))
alloclen = fraglen;
else {
- alloclen = fragheaderlen + transhdrlen;
- pagedlen = datalen - transhdrlen;
+ alloclen = fragheaderlen + transhdrlen + fraggap;
+ pagedlen = datalen - transhdrlen - fraggap;
}
alloclen += alloc_extra;

@@ -1683,10 +1683,7 @@ alloc_new_skb:
fraglen = datalen + fragheaderlen;

copy = datalen - transhdrlen - fraggap - pagedlen;
- /* [!] NOTE: copy may be negative if pagedlen>0
- * because then the equation may reduces to -fraggap.
- */
- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) {
+ if (copy < 0) {
err = -EINVAL;
goto error;
}
--
cgit 1.3-korg

6 changes: 5 additions & 1 deletion SPECS/kernel-64k/kernel-64k.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
Summary: Linux Kernel
Name: kernel-64k
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -41,6 +41,7 @@ Source4: cpupower
Source5: cpupower.service
Patch0: 0001-add-mstflint-kernel-%{mstflintver}.patch
Patch1: 0002-efi-Added-efi-cmdline-line-option-to-dynamically-adj.patch
Patch2: 0001-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch
ExclusiveArch: aarch64
BuildRequires: audit-devel
BuildRequires: bash
Expand Down Expand Up @@ -380,6 +381,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%{_sysconfdir}/bash_completion.d/bpftool

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Backport upstream torvalds/linux@736b380e28d0 ("ipv6: account for fraggap on the paged allocation path") to fix an OOB-write in __ip6_append_data().

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
5 changes: 4 additions & 1 deletion SPECS/kernel-headers/kernel-headers.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
Summary: Linux API header files
Name: kernel-headers
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -75,6 +75,9 @@ done
%endif

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Release bump to stay in lockstep with the kernel spec entanglement group for the ipv6 fraggap fix (torvalds/linux@736b380e28d0).

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
79 changes: 79 additions & 0 deletions SPECS/kernel/0001-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
From 736b380e28d0480c7bc3e022f1950f31fe53a7c5 Mon Sep 17 00:00:00 2001
From: Wongi Lee <qw3rtyp0@gmail.com>
Date: Tue, 16 Jun 2026 22:46:17 +0900
Subject: ipv6: account for fraggap on the paged allocation path

In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as

alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;

datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.

An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.

The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.

The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc")
Signed-off-by: Jungwoo Lee <jwlee2217@gmail.com>
Signed-off-by: Wongi Lee <qw3rtyp0@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
net/ipv6/ip6_output.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9f1e0e4f74641..368e4fa3b43ca 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1667,8 +1667,8 @@ alloc_new_skb:
!(rt->dst.dev->features & NETIF_F_SG)))
alloclen = fraglen;
else {
- alloclen = fragheaderlen + transhdrlen;
- pagedlen = datalen - transhdrlen;
+ alloclen = fragheaderlen + transhdrlen + fraggap;
+ pagedlen = datalen - transhdrlen - fraggap;
}
alloclen += alloc_extra;

@@ -1683,10 +1683,7 @@ alloc_new_skb:
fraglen = datalen + fragheaderlen;

copy = datalen - transhdrlen - fraggap - pagedlen;
- /* [!] NOTE: copy may be negative if pagedlen>0
- * because then the equation may reduces to -fraggap.
- */
- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) {
+ if (copy < 0) {
err = -EINVAL;
goto error;
}
--
cgit 1.3-korg

5 changes: 4 additions & 1 deletion SPECS/kernel/kernel-uki.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
Summary: Unified Kernel Image
Name: kernel-uki
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -70,6 +70,9 @@ cp %{buildroot}/boot/vmlinuz-uki-%{kernelver}.efi %{buildroot}/boot/efi/EFI/Linu
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Release bump to stay in lockstep with the kernel spec entanglement group for the ipv6 fraggap fix (torvalds/linux@736b380e28d0).

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
8 changes: 7 additions & 1 deletion SPECS/kernel/kernel.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
Summary: Linux Kernel
Name: kernel
Version: 6.6.143.1
Release: 1%{?dist}
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -46,6 +46,9 @@ Source4: azurelinux-ca-20230216.pem
Source5: cpupower
Source6: cpupower.service
Patch0: 0001-add-mstflint-kernel-%{mstflintver}.patch
# Backport of upstream torvalds/linux@736b380e28d0 ("ipv6: account for fraggap
# on the paged allocation path"): fixes an OOB-write in __ip6_append_data().
Patch1: 0001-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch
BuildRequires: audit-devel
BuildRequires: bash
BuildRequires: bc
Expand Down Expand Up @@ -440,6 +443,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
%{_sysconfdir}/bash_completion.d/bpftool

%changelog
* Mon Jun 29 2026 Omkhar Arasaratnam <omkhar@linkedin.com> - 6.6.143.1-2
- Backport upstream torvalds/linux@736b380e28d0 ("ipv6: account for fraggap on the paged allocation path") to fix an OOB-write in __ip6_append_data().

* Wed Jun 24 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.143.1-1
- Auto-upgrade to 6.6.143.1

Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-21.azl3.aarch64.rpm
kernel-headers-6.6.143.1-1.azl3.noarch.rpm
kernel-headers-6.6.143.1-2.azl3.noarch.rpm
glibc-2.38-20.azl3.aarch64.rpm
glibc-devel-2.38-20.azl3.aarch64.rpm
glibc-i18n-2.38-20.azl3.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
filesystem-1.1-21.azl3.x86_64.rpm
kernel-headers-6.6.143.1-1.azl3.noarch.rpm
kernel-headers-6.6.143.1-2.azl3.noarch.rpm
glibc-2.38-20.azl3.x86_64.rpm
glibc-devel-2.38-20.azl3.x86_64.rpm
glibc-i18n-2.38-20.azl3.x86_64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.aarch64.rpm
kbd-debuginfo-2.2.0-2.azl3.aarch64.rpm
kernel-headers-6.6.143.1-1.azl3.noarch.rpm
kernel-headers-6.6.143.1-2.azl3.noarch.rpm
kmod-30-1.azl3.aarch64.rpm
kmod-debuginfo-30-1.azl3.aarch64.rpm
kmod-devel-30-1.azl3.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,8 +165,8 @@ intltool-0.51.0-7.azl3.noarch.rpm
itstool-2.0.7-1.azl3.noarch.rpm
kbd-2.2.0-2.azl3.x86_64.rpm
kbd-debuginfo-2.2.0-2.azl3.x86_64.rpm
kernel-cross-headers-6.6.143.1-1.azl3.noarch.rpm
kernel-headers-6.6.143.1-1.azl3.noarch.rpm
kernel-cross-headers-6.6.143.1-2.azl3.noarch.rpm
kernel-headers-6.6.143.1-2.azl3.noarch.rpm
kmod-30-1.azl3.x86_64.rpm
kmod-debuginfo-30-1.azl3.x86_64.rpm
kmod-devel-30-1.azl3.x86_64.rpm
Expand Down
Loading