Add patches to kernel-6.1, kernel-6.12, and kernel-6.18

CHANGELOG.md

@@ -1,3 +1,11 @@
+# v9.1.3 (2026-09-18)
+
+## OS Changes
+
+* Backport patches to fix TUN and AH6 bugs in the networking stack ([#559])
+
+[#559]: https://github.com/bottlerocket-os/bottlerocket-kernel-kit/pull/559
+
 # v9.1.2 (2026-09-14)
 
 ## OS Changes

Twoliter.toml

@@ -1,5 +1,5 @@
 schema-version = 2
-release-version = "9.1.2"
+release-version = "9.1.3"
 project-vendor = "Bottlerocket"
 
 [vendor.bottlerocket]

packages/kernel-6.1/1009-xfrm-ah6-validate-routing-header-segments_left.patch

@@ -0,0 +1,106 @@
+From 1b7e066eabcc7d6d8f476c34739b45932f2f4c31 Mon Sep 17 00:00:00 2001
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+Date: Thu, 23 Jul 2026 09:35:48 +0000
+Subject: xfrm: ah6: validate routing header segments_left
+
+commit 7bad4bda74dc4713f398d3b7624ff05478e3a568 upstream.
+
+AH6 rearranges routing-header addresses before computing or verifying the
+ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
+the number of addresses described by the routing header's hdrlen field.
+
+That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
+hdrlen equal to 2 describes one address, but can carry an arbitrary
+segments_left value. With segments_left equal to 255, the function moves
+its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
+memmove(), resulting in an out-of-bounds access.
+
+Validate the invariant locally before modifying the routing header or
+performing any address-pointer arithmetic, and propagate malformed-header
+errors to the existing AH6 input and output error paths.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
+Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Maher Homsi <maherhom@amazon.com>
+---
+ net/ipv6/ah6.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 434071b5a37f0..d9543dbf4c937 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -232,26 +232,28 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
+  *	Rearrange the destination address in @iph and the addresses in @rthdr
+  *	so that they appear in the order they will at the final destination.
+  *	See Appendix A2 of RFC 2402 for details.
++ *
++ * Return: 0 on success, -EINVAL if segments_left exceeds the number of
++ * addresses described by hdrlen.
+  */
+-static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
++static int ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
+ {
+-	int segments, segments_left;
++	unsigned int segments, segments_left;
+ 	struct in6_addr *addrs;
+ 	struct in6_addr final_addr;
+
+ 	segments_left = rthdr->segments_left;
+ 	if (segments_left == 0)
+-		return;
+-	rthdr->segments_left = 0;
++		return 0;
+
+-	/* The value of rthdr->hdrlen has been verified either by the system
+-	 * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
+-	 * packets.  So we can assume that it is even and that segments is
+-	 * greater than or equal to segments_left.
+-	 *
+-	 * For the same reason we can assume that this option is of type 0.
++	/* Raw locally generated packets can reach AH6 without the invariant
++	 * required by the rt0-style address rearrangement below.
+ 	 */
+ 	segments = rthdr->hdrlen >> 1;
++	if (segments_left > segments)
++		return -EINVAL;
++
++	rthdr->segments_left = 0;
+
+ 	addrs = ((struct rt0_hdr *)rthdr)->addr;
+ 	final_addr = addrs[segments - 1];
+@@ -261,6 +263,8 @@ static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
+
+ 	addrs[0] = iph->daddr;
+ 	iph->daddr = final_addr;
++
++	return 0;
+ }
+
+ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+@@ -273,6 +277,7 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+ 	} exthdr = { .iph = iph };
+ 	char *end = exthdr.raw + len;
+ 	int nexthdr = iph->nexthdr;
++	int err;
+
+ 	exthdr.iph++;
+
+@@ -292,7 +297,9 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+ 			break;
+
+ 		case NEXTHDR_ROUTING:
+-			ipv6_rearrange_rthdr(iph, exthdr.rth);
++			err = ipv6_rearrange_rthdr(iph, exthdr.rth);
++			if (err)
++				return err;
+ 			break;
+
+ 		default:
+-- 
+cgit 1.3.1-korg
+

packages/kernel-6.1/1010-net-tun-bound-receive-headroom.patch

@@ -0,0 +1,88 @@
+From 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76 Mon Sep 17 00:00:00 2001
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+Date: Wed, 12 Aug 2026 01:21:53 +0000
+Subject: net: tun: bound receive headroom
+
+commit 447c9303942c439a117d9b76ce6d6e2116b38ee7 upstream.
+
+tun_get_user() uses tun->align both as skb headroom and when choosing how
+much packet data to keep linear. OVS can propagate an oversized headroom
+request from another port to TUN or TAP.
+
+When align is larger than the usable space in a one-page skb head,
+SKB_MAX_HEAD(align) underflows and the result becomes negative when stored
+in good_linear. That value later wraps when assigned to the size_t linear
+variable, and tun_alloc_skb() can place skb->data outside the allocated
+head.
+
+Bound the headroom stored by TUN to the one-page skb-head budget and the
+largest non-sentinel 16-bit skb header offset. Leave one linear byte for
+raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
+
+Also pull the raw-TUN protocol byte and the TAP Ethernet header before
+accessing them, so these checks remain safe for nonlinear skbs supplied by
+other allocation paths.
+
+Fixes: eaea34b23c46 ("net/tun: implement ndo_set_rx_headroom")
+Cc: stable@vger.kernel.org
+Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20260812012139.2134643-1-manizada@pm.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Maher Homsi <maherhom@amazon.com>
+---
+ drivers/net/tun.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index e8f8c7d5df29e..6e021a7caa07a 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1175,11 +1175,16 @@ static netdev_features_t tun_net_fix_features(struct net_device *dev,
+ static void tun_set_headroom(struct net_device *dev, int new_hr)
+ {
+ 	struct tun_struct *tun = netdev_priv(dev);
++	size_t max_headroom;
+
+-	if (new_hr < NET_SKB_PAD)
+-		new_hr = NET_SKB_PAD;
++	max_headroom = min_t(size_t, SKB_MAX_HEAD(0), U16_MAX - 1);
+
+-	tun->align = new_hr;
++	if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP)
++		max_headroom -= ETH_HLEN + NET_IP_ALIGN;
++	else
++		max_headroom -= 1;
++
++	tun->align = clamp_t(int, new_hr, NET_SKB_PAD, max_headroom);
+ }
+
+ static void
+@@ -1868,7 +1873,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 	switch (tun->flags & TUN_TYPE_MASK) {
+ 	case IFF_TUN:
+ 		if (tun->flags & IFF_NO_PI) {
+-			u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
++			u8 ip_version;
++
++			if (!pskb_may_pull(skb, 1)) {
++				err = -EINVAL;
++				goto drop;
++			}
++			ip_version = skb->data[0] >> 4;
+
+ 			switch (ip_version) {
+ 			case 4:
+@@ -1888,7 +1899,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 		skb->dev = tun->dev;
+ 		break;
+ 	case IFF_TAP:
+-		if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
++		if (!pskb_may_pull(skb, ETH_HLEN)) {
+ 			err = -ENOMEM;
+ 			drop_reason = SKB_DROP_REASON_HDR_TRUNC;
+ 			goto drop;
+-- 
+cgit 1.3.1-korg
+

packages/kernel-6.1/kernel-6.1.spec

@@ -64,6 +64,10 @@ Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch
 Patch1007: 1007-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch
 # Initialize modname and offset in ftrace print_rec() to avoid GP fault
 Patch1008: 1008-ftrace-initialize-modname-and-offset-in-print_rec.patch
+# Validate IPv6 routing header segments_left in AH6 to avoid OOB access
+Patch1009: 1009-xfrm-ah6-validate-routing-header-segments_left.patch
+# Bound tun receive headroom to prevent skb overflow
+Patch1010: 1010-net-tun-bound-receive-headroom.patch
 
 BuildRequires: bc
 BuildRequires: elfutils-devel

packages/kernel-6.12/1011-xfrm-ah6-validate-routing-header-segments_left.patch

@@ -0,0 +1,106 @@
+From 1516e31ac458a738be485620579d8f7fb2700fcb Mon Sep 17 00:00:00 2001
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+Date: Thu, 23 Jul 2026 09:35:48 +0000
+Subject: xfrm: ah6: validate routing header segments_left
+
+commit 7bad4bda74dc4713f398d3b7624ff05478e3a568 upstream.
+
+AH6 rearranges routing-header addresses before computing or verifying the
+ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
+the number of addresses described by the routing header's hdrlen field.
+
+That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
+hdrlen equal to 2 describes one address, but can carry an arbitrary
+segments_left value. With segments_left equal to 255, the function moves
+its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
+memmove(), resulting in an out-of-bounds access.
+
+Validate the invariant locally before modifying the routing header or
+performing any address-pointer arithmetic, and propagate malformed-header
+errors to the existing AH6 input and output error paths.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
+Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Maher Homsi <maherhom@amazon.com>
+---
+ net/ipv6/ah6.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index bf4e11614af25..188397b9a9db0 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -232,26 +232,28 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
+  *	Rearrange the destination address in @iph and the addresses in @rthdr
+  *	so that they appear in the order they will at the final destination.
+  *	See Appendix A2 of RFC 2402 for details.
++ *
++ * Return: 0 on success, -EINVAL if segments_left exceeds the number of
++ * addresses described by hdrlen.
+  */
+-static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
++static int ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
+ {
+-	int segments, segments_left;
++	unsigned int segments, segments_left;
+ 	struct in6_addr *addrs;
+ 	struct in6_addr final_addr;
+
+ 	segments_left = rthdr->segments_left;
+ 	if (segments_left == 0)
+-		return;
+-	rthdr->segments_left = 0;
++		return 0;
+
+-	/* The value of rthdr->hdrlen has been verified either by the system
+-	 * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
+-	 * packets.  So we can assume that it is even and that segments is
+-	 * greater than or equal to segments_left.
+-	 *
+-	 * For the same reason we can assume that this option is of type 0.
++	/* Raw locally generated packets can reach AH6 without the invariant
++	 * required by the rt0-style address rearrangement below.
+ 	 */
+ 	segments = rthdr->hdrlen >> 1;
++	if (segments_left > segments)
++		return -EINVAL;
++
++	rthdr->segments_left = 0;
+
+ 	addrs = ((struct rt0_hdr *)rthdr)->addr;
+ 	final_addr = addrs[segments - 1];
+@@ -261,6 +263,8 @@ static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
+
+ 	addrs[0] = iph->daddr;
+ 	iph->daddr = final_addr;
++
++	return 0;
+ }
+
+ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+@@ -273,6 +277,7 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+ 	} exthdr = { .iph = iph };
+ 	char *end = exthdr.raw + len;
+ 	int nexthdr = iph->nexthdr;
++	int err;
+
+ 	exthdr.iph++;
+
+@@ -292,7 +297,9 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
+ 			break;
+
+ 		case NEXTHDR_ROUTING:
+-			ipv6_rearrange_rthdr(iph, exthdr.rth);
++			err = ipv6_rearrange_rthdr(iph, exthdr.rth);
++			if (err)
++				return err;
+ 			break;
+
+ 		default:
+-- 
+cgit 1.3.1-korg
+