linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Kyle Zeng eb0f422487 ipv6: seg6: clear IPv4 control block on IPIP decapsulation commit `44930446dd` upstream. End.DX4 and End.DT4 decapsulate an IPv4 packet through decap_and_validate() and send it directly to IPv4 routing. The inner packet therefore bypasses ip_rcv_core(), which normally clears IPCB before IPv4 interprets skb->cb. The skb instead retains IP6CB data from the outer packet. IP6CB and IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and ts. The sender can make the stale optlen byte nonzero with a valid outer extension-header chain. The reproducers put an eight-byte Destination Options header immediately after the 40-byte IPv6 header and before the Segment Routing Header. ipv6_destopt_rcv() records the sender-controlled Destination Options offset in both lastopt and nhoff, setting them to 40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees optlen = 40 and rr = 40. Both tcp_v4_save_options() and __ip_options_echo() skip option copying when optlen is zero. Here optlen is 40, so the TCP SYN path allocates room for 40 bytes of option data and calls __ip_options_echo(). The stale rr value makes that function read inner packet byte 41 as the Record Route option length. The reproducers set that sender-controlled byte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte option-data area. Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5 kernel both produced: BUG: KASAN: slab-out-of-bounds in __ip_options_echo() Write of size 255 The relevant End.DX4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dx4_finish input_action_end_dx4 The relevant End.DT4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dt4 tcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so it does not appear as a separate frame. When decap_and_validate() handles IPPROTO_IPIP, save the ingress interface from IP6CB, clear IPCB, and restore the saved value. Doing this in the common decapsulation path covers End.DX4, End.DT4, and End.DT46's IPv4 arm. Use IP6CB(skb)->iif rather than skb->skb_iif. These actions run after l3mdev processing, which can replace skb_iif with the L3 master; IP6CB iif still records the receiving interface set at IPv6 ingress. Fixes: `891ef8dd2a` ("ipv6: sr: implement additional seg6local actions") Cc: stable@vger.kernel.org Suggested-by: Andrea Mayer <andrea.mayer@uniroma2.it> Signed-off-by: Kyle Zeng <kylebot@openai.com> Co-developed-by: David Lee <david.lee@trailofbits.com> Signed-off-by: David Lee <david.lee@trailofbits.com> Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it> Link: https://patch.msgid.link/20260817085839.946321-1-david.lee@trailofbits.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-09-02 14:27:28 +02:00
arch	KVM: arm64: Prevent access to vCPU events before init	2026-09-02 14:27:26 +02:00
block	partitions: aix: bound the pp_count scan to the ppe array	2026-07-24 15:51:24 +02:00
certs	X.509: Fix validation of ASN.1 certificate header	2026-07-24 15:51:59 +02:00
crypto	crypto: ccm - Set rfc4309 maxauthsize from child	2026-08-23 14:17:31 +02:00
Documentation	PCI: Move Resizable BAR code to rebar.c	2026-07-24 15:51:58 +02:00
drivers	usb: gadget: f_tcm: keep port count until LUN teardown completes	2026-09-02 14:27:28 +02:00
fs	fuse: fix invalidate lock leak on open O_TRUNC DAX failure	2026-09-02 14:27:28 +02:00
include	usb: gadget: f_tcm: keep port count until LUN teardown completes	2026-09-02 14:27:28 +02:00
init	bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c	2026-08-23 14:17:24 +02:00
io_uring	io_uring/io-wq: fix worker accounting when canceling creation callbacks	2026-09-02 14:27:25 +02:00
ipc	ipc/shm: serialize orphan cleanup with shm_nattch updates	2026-06-19 13:33:38 +02:00
kernel	kcov: fix data corruption and race conditions on PREEMPT_RT	2026-09-02 14:27:27 +02:00
lib	kcov: fix data corruption and race conditions on PREEMPT_RT	2026-09-02 14:27:27 +02:00
LICENSES	LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes"	2021-07-15 06:31:24 -06:00
mm	mm/huge_memory: fix huge_zero_pfn race	2026-08-27 14:28:19 +02:00
net	ipv6: seg6: clear IPv4 control block on IPIP decapsulation	2026-09-02 14:27:28 +02:00
samples	tracing/events: Fix to check the simple_tsk_fn creation	2026-07-24 15:51:42 +02:00
scripts	kconfig: fix potential NULL pointer dereference in conf_askvalue	2026-07-24 15:51:28 +02:00
security	selinux: switch two allocations to use kzalloc_objs()	2026-09-02 14:27:26 +02:00
sound	ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams	2026-09-02 14:27:26 +02:00
tools	selftests/ftrace: refactor eprobes test to fix argument checks	2026-08-19 17:14:13 +02:00
usr	kbuild: hdrcheck: fix cross build with clang	2025-06-27 11:05:22 +01:00
virt	KVM: Rename mmu_notifier_* to mmu_invalidate_*	2026-08-27 14:28:21 +02:00
.clang-format	clang-format: Update with the latest for_each macro list	2021-05-12 23:32:39 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	Remove *.orig pattern from .gitignore	2024-10-17 15:11:10 +02:00
.mailmap	mailmap: add Andrej Shadura	2021-10-18 20:22:03 -10:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Daniel Drake to credits	2021-09-21 08:34:58 +03:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	staging: rtl8712: Remove driver using deprecated API wext	2025-12-07 06:09:36 +09:00
Makefile	Linux 5.15.219	2026-08-28 08:20:31 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.