Re: [PATCH net 1/1] ipmr: validate VIF indexes before offload lookup

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Oct 13, 2026 at 10:33:57PM +0800, Zhiling Zou wrote:
> ipmr_find_vif() can return -1 when a packet races with VIF publication.
> ipmr_forward_offloaded() forms pointers into mrt->vif_table before
> checking the packet's offload mark, so a negative index is out of bounds.

Please clarify in the commit message that out-of-bounds access only
occurs when the skb is marked, which can only happen with mlxsw. Even
then, this condition is rare. The PoC only reproduces a UBSAN splat
which complains about the negative array index.

> 
> Validate both VIF indexes before forming pointers into vif_table. Invalid
> indexes fall back to the regular software forwarding path.
> 
> Fixes: 4eadb88244d1 ("ipmr: do not acquire mrt_lock while calling ip_mr_forward()")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>  net/ipv4/ipmr.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index b9c544d48c45..bc3263d15a44 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -1879,11 +1879,16 @@ static inline int ipmr_forward_finish(struct net *net, struct sock *sk,
>  static bool ipmr_forward_offloaded(struct sk_buff *skb, struct mr_table *mrt,
>  				   int in_vifi, int out_vifi)
>  {
> -	struct vif_device *out_vif = &mrt->vif_table[out_vifi];
> -	struct vif_device *in_vif = &mrt->vif_table[in_vifi];
> +	struct vif_device *out_vif, *in_vif;
>  
>  	if (!skb->offload_l3_fwd_mark)
>  		return false;
> +	if (in_vifi < 0 || in_vifi >= MAXVIFS ||
> +	    out_vifi < 0 || out_vifi >= MAXVIFS)

Don't you only need to validate 'in_vifi < 0'? I don't see how the
indexes can exceed 'MAXVIFS', and 'out_vifi' can't be negative.

> +		return false;
> +
> +	out_vif = &mrt->vif_table[out_vifi];
> +	in_vif = &mrt->vif_table[in_vifi];
>  	if (!out_vif->dev_parent_id.id_len || !in_vif->dev_parent_id.id_len)
>  		return false;
>  	return netdev_phys_item_id_same(&out_vif->dev_parent_id,
> -- 
> 2.55.0
>