From 2db3956c31f577145431d646861132660bdd03c5 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Fri, 3 Jul 2026 02:57:10 +0000 Subject: [PATCH 1/4] kernel-6.1: backport patches to fix undersized allocation in IPv* Signed-off-by: Arnaldo Garcia Rincon --- ...-fraggap-on-the-paged-allocation-pat.patch | 58 ++++++++++++++++ ...-fraggap-on-the-paged-allocation-pat.patch | 68 +++++++++++++++++++ packages/kernel-6.1/kernel-6.1.spec | 3 + 3 files changed, 129 insertions(+) create mode 100644 packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch create mode 100644 packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch diff --git a/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..586cd505 --- /dev/null +++ b/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,58 @@ +From 40d30498c8ea3e3495642f8cc5c263cb13d55b76 Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:38:29 +0900 +Subject: [PATCH] ipv4: account for fraggap on the paged allocation path + +In __ip_append_data(), when the paged-allocation branch is taken, +alloclen and pagedlen are computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap, but the fraggap bytes carried over +from the previous skb are copied into the new skb's linear area at +offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The +linear area is therefore undersized by fraggap bytes while pagedlen is +overstated by the same amount. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. + +Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski + +[Resolve merge conflict caused by missing 5204ccbfa223 which wraps +INDIRECT_CALL_1. Resolve the merge conflict by keeping current logic.] + +Signed-off-by: Stanislav Uschakow +(cherry picked from commit d11d68214a0afab174ab8f712890452adcf7c196) +--- + net/ipv4/ip_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index f5a2ad2b2dbdf..778214137e4a2 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1117,8 +1117,8 @@ static int __ip_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + + alloclen += alloc_extra; +-- +2.52.0 + diff --git a/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..b8167ecd --- /dev/null +++ b/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,68 @@ +From 39ac6b1dc849d9aed2044d7ae77681b03b482ebc Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:46:17 +0900 +Subject: [PATCH] ipv6: account for fraggap on the paged allocation path + +In __ip6_append_data(), when the paged-allocation branch is taken +(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are +computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap (datalen = length + fraggap). When +fraggap is non-zero, this is not the first skb and transhdrlen is zero. +The fraggap bytes carried over from the previous skb are copied just past +the fragment headers in the new skb's linear area. The linear area is +therefore undersized by fraggap bytes while pagedlen is overstated by the +same amount, and the copy writes past skb->end into the trailing +skb_shared_info. + +An unprivileged user can trigger this via a UDPv6 socket using +MSG_MORE together with MSG_SPLICE_PAGES. + +The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: +avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix +__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative +copy value caused -EINVAL to be returned. That later commit allowed +MSG_SPLICE_PAGES to proceed in this case, making the corruption +triggerable. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. +Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES +case, remove the MSG_SPLICE_PAGES exception from the negative copy check. + +Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +(cherry picked from commit 93e5d33ee907c1f053a83e108b6fa00fecc32ce2) +--- + net/ipv6/ip6_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 1e491fa7793ad..d8ce708fcb3c4 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1622,8 +1622,8 @@ static int __ip6_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + alloclen += alloc_extra; + +-- +2.52.0 + diff --git a/packages/kernel-6.1/kernel-6.1.spec b/packages/kernel-6.1/kernel-6.1.spec index 79e7a5d9..a4e5da7c 100644 --- a/packages/kernel-6.1/kernel-6.1.spec +++ b/packages/kernel-6.1/kernel-6.1.spec @@ -48,6 +48,9 @@ Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1007: 1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +# Fix undersized linear allocation in IPv* paged path +Patch1008: 1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch +Patch1009: 1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch BuildRequires: bc BuildRequires: elfutils-devel From bee73e998558236c48138d6087dea54c461cf071 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Fri, 3 Jul 2026 02:58:25 +0000 Subject: [PATCH 2/4] kernel-6.12: backport patches to fix undersized allocation in IPv* Signed-off-by: Arnaldo Garcia Rincon --- ...-fraggap-on-the-paged-allocation-pat.patch | 80 +++++++++++++++++++ ...-fraggap-on-the-paged-allocation-pat.patch | 71 ++++++++++++++++ packages/kernel-6.12/kernel-6.12.spec | 3 + 3 files changed, 154 insertions(+) create mode 100644 packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch create mode 100644 packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch diff --git a/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..93a7e119 --- /dev/null +++ b/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,80 @@ +From e11f74586e81533758387d0cd1fca6de5daf589b Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:46:17 +0900 +Subject: [PATCH] ipv6: account for fraggap on the paged allocation path + +In __ip6_append_data(), when the paged-allocation branch is taken +(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are +computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap (datalen = length + fraggap). When +fraggap is non-zero, this is not the first skb and transhdrlen is zero. +The fraggap bytes carried over from the previous skb are copied just past +the fragment headers in the new skb's linear area. The linear area is +therefore undersized by fraggap bytes while pagedlen is overstated by the +same amount, and the copy writes past skb->end into the trailing +skb_shared_info. + +An unprivileged user can trigger this via a UDPv6 socket using +MSG_MORE together with MSG_SPLICE_PAGES. + +The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: +avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix +__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative +copy value caused -EINVAL to be returned. That later commit allowed +MSG_SPLICE_PAGES to proceed in this case, making the corruption +triggerable. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. +Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES +case, remove the MSG_SPLICE_PAGES exception from the negative copy check. + +Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +(cherry picked from commit b8b9e9717384610556ade742dda516e6d060ef52) +--- + net/ipv6/ip6_output.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 31021dc40e52..3804ead05a35 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1633,8 +1633,8 @@ static int __ip6_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + alloclen += alloc_extra; + +@@ -1649,10 +1649,7 @@ static int __ip6_append_data(struct sock *sk, + fraglen = datalen + fragheaderlen; + + copy = datalen - transhdrlen - fraggap - pagedlen; +- /* [!] NOTE: copy may be negative if pagedlen>0 +- * because then the equation may reduces to -fraggap. +- */ +- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) { ++ if (copy < 0) { + err = -EINVAL; + goto error; + } +-- +2.52.0 + diff --git a/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..e7318a89 --- /dev/null +++ b/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,71 @@ +From ee652c3f488fae4e2ded16484edeffbf9f21ab4f Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:38:29 +0900 +Subject: [PATCH] ipv4: account for fraggap on the paged allocation path + +[Upstream commit eca856950f7cb1a221e02b99d758409f2c5cec42] + +In __ip_append_data(), when the paged-allocation branch is taken, +alloclen and pagedlen are computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap, but the fraggap bytes carried over +from the previous skb are copied into the new skb's linear area at +offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The +linear area is therefore undersized by fraggap bytes while pagedlen is +overstated by the same amount. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. + +Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski + +[Resolve merge conflict caused by missing 5204ccbfa223 which wraps +INDIRECT_CALL_1. Resolve the merge conflict by keeping current logic.] + +Signed-off-by: Stanislav Uschakow +(cherry picked from commit 0cdc534c594541ceb3d3e4f0b6b3141177e652a0) +--- + net/ipv4/ip_output.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index ba51fc42531c..66e8d2181b62 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1118,8 +1118,8 @@ static int __ip_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + + alloclen += alloc_extra; +@@ -1166,9 +1166,7 @@ static int __ip_append_data(struct sock *sk, + } + + copy = datalen - transhdrlen - fraggap - pagedlen; +- /* [!] NOTE: copy will be negative if pagedlen>0 +- * because then the equation reduces to -fraggap. +- */ ++ + if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { + err = -EFAULT; + kfree_skb(skb); +-- +2.52.0 + diff --git a/packages/kernel-6.12/kernel-6.12.spec b/packages/kernel-6.12/kernel-6.12.spec index 84615bf4..15c27bfc 100644 --- a/packages/kernel-6.12/kernel-6.12.spec +++ b/packages/kernel-6.12/kernel-6.12.spec @@ -50,6 +50,9 @@ Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1008: 1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +# Fix undersized linear allocation in IPv* paged path +Patch1009: 1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch +Patch1010: 1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch BuildRequires: bc BuildRequires: elfutils-devel From 9564a3df0bd0a8379833c743368a17fd5c8626a1 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Fri, 3 Jul 2026 02:58:55 +0000 Subject: [PATCH 3/4] kernel-6.18: backport patches to fix undersized allocation in IPv* Signed-off-by: Arnaldo Garcia Rincon --- ...-fraggap-on-the-paged-allocation-pat.patch | 63 +++++++++++++++ ...-fraggap-on-the-paged-allocation-pat.patch | 80 +++++++++++++++++++ packages/kernel-6.18/kernel-6.18.spec | 3 + 3 files changed, 146 insertions(+) create mode 100644 packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch create mode 100644 packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch diff --git a/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..4df30c5a --- /dev/null +++ b/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,63 @@ +From c75fbac419a8772b7f42d16b12ae986d1eb0d85e Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:38:29 +0900 +Subject: [PATCH] ipv4: account for fraggap on the paged allocation path + +In __ip_append_data(), when the paged-allocation branch is taken, +alloclen and pagedlen are computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap, but the fraggap bytes carried over +from the previous skb are copied into the new skb's linear area at +offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The +linear area is therefore undersized by fraggap bytes while pagedlen is +overstated by the same amount. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. + +Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +(cherry picked from commit dab46d2102cc219b12017a0447b57a42358895c8) +--- + net/ipv4/ip_output.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 7c005263262ff..7eaf35a6e24ba 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1117,8 +1117,8 @@ static int __ip_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + + alloclen += alloc_extra; +@@ -1165,9 +1165,6 @@ static int __ip_append_data(struct sock *sk, + } + + copy = datalen - transhdrlen - fraggap - pagedlen; +- /* [!] NOTE: copy will be negative if pagedlen>0 +- * because then the equation reduces to -fraggap. +- */ + if (copy > 0 && + INDIRECT_CALL_1(getfrag, ip_generic_getfrag, + from, data + transhdrlen, offset, +-- +2.52.0 + diff --git a/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch new file mode 100644 index 00000000..d106ee6b --- /dev/null +++ b/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch @@ -0,0 +1,80 @@ +From 1f422250a5022141881fddd368c3038a687fa438 Mon Sep 17 00:00:00 2001 +From: Wongi Lee +Date: Tue, 16 Jun 2026 22:46:17 +0900 +Subject: [PATCH] ipv6: account for fraggap on the paged allocation path + +In __ip6_append_data(), when the paged-allocation branch is taken +(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are +computed as + + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + +datalen already includes fraggap (datalen = length + fraggap). When +fraggap is non-zero, this is not the first skb and transhdrlen is zero. +The fraggap bytes carried over from the previous skb are copied just past +the fragment headers in the new skb's linear area. The linear area is +therefore undersized by fraggap bytes while pagedlen is overstated by the +same amount, and the copy writes past skb->end into the trailing +skb_shared_info. + +An unprivileged user can trigger this via a UDPv6 socket using +MSG_MORE together with MSG_SPLICE_PAGES. + +The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: +avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix +__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative +copy value caused -EINVAL to be returned. That later commit allowed +MSG_SPLICE_PAGES to proceed in this case, making the corruption +triggerable. + +The non-paged branch sets alloclen to fraglen, which already accounts +for fraggap because datalen does. Bring the paged branch in line by +adding fraggap to alloclen and subtracting it from pagedlen. + +After this adjustment, copy no longer collapses to -fraggap on the +paged path, so remove the stale comment describing that old arithmetic. +Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES +case, remove the MSG_SPLICE_PAGES exception from the negative copy check. + +Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") +Signed-off-by: Jungwoo Lee +Signed-off-by: Wongi Lee +Reviewed-by: Ido Schimmel +Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain +Signed-off-by: Jakub Kicinski +(cherry picked from commit 836f5052c83121849fd12c8e88f736b0e0ed89be) +--- + net/ipv6/ip6_output.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index f5ca0267e7706..8f37c9cc868b0 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1648,8 +1648,8 @@ static int __ip6_append_data(struct sock *sk, + !(rt->dst.dev->features & NETIF_F_SG))) + alloclen = fraglen; + else { +- alloclen = fragheaderlen + transhdrlen; +- pagedlen = datalen - transhdrlen; ++ alloclen = fragheaderlen + transhdrlen + fraggap; ++ pagedlen = datalen - transhdrlen - fraggap; + } + alloclen += alloc_extra; + +@@ -1664,10 +1664,7 @@ static int __ip6_append_data(struct sock *sk, + fraglen = datalen + fragheaderlen; + + copy = datalen - transhdrlen - fraggap - pagedlen; +- /* [!] NOTE: copy may be negative if pagedlen>0 +- * because then the equation may reduces to -fraggap. +- */ +- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) { ++ if (copy < 0) { + err = -EINVAL; + goto error; + } +-- +2.52.0 + diff --git a/packages/kernel-6.18/kernel-6.18.spec b/packages/kernel-6.18/kernel-6.18.spec index 67830c48..ed3c35da 100644 --- a/packages/kernel-6.18/kernel-6.18.spec +++ b/packages/kernel-6.18/kernel-6.18.spec @@ -44,6 +44,9 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +# Fix undersized linear allocation in IPv* paged path +Patch1007: 1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch +Patch1008: 1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch BuildRequires: bc BuildRequires: elfutils-devel From 5b4a4d66bdc1ef99a5787a3685d8fad8a5cbf7b1 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Fri, 3 Jul 2026 03:09:52 +0000 Subject: [PATCH 4/4] changelog: add entry for 6.3.0 Signed-off-by: Arnaldo Garcia Rincon --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09024475..190e2c50 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,11 @@ ## OS Changes -* Add `gdrcopy` kernel module for nvidia open-source GPU drivers ([#462]) +* Add `gdrcopy` kernel module for nvidia open-source GPU drivers ([#462]) +* Backport patches to prevent undersized allocation in IPv* ([#481]) [#462]: https://github.com/bottlerocket-os/bottlerocket-kernel-kit/pull/462 +[#481]: https://github.com/bottlerocket-os/bottlerocket-kernel-kit/pull/481 # v6.2.3 (2026-06-29)