From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590166; b=1+Jsjl84QZMwFlaRsBtdip/fIOuCtmL9QcTdl9FricvTmQnwfRkd/gYFno5U55Ke9mxK /JqEwZp+J6j1N6ey+QrYtMyK+Hwtf9TPi7b/orfm94hNZ3fylQ9n35CjZcjdCnlvx3pT5 bQ2cCH7NUCaZIuMFu64fHi8YySUbvxe0LEF486sng78XEdPWl50ji04JhJqZsIh7xOU82 rn9Ryzf6H6KsJd+GbOL4on20VBXvCgjzqcZHuQuPL7nwqYBBwGntnRVRFyJkh8uuqr0/Q 8mEtKDMLc3eYUEj3DEelpZhq5lv1KAvRM4JkT77YOSfAz6fVPbQiTLnBQO7lRwCAfcg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590166; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=47z5nEaslxCSAv1byN4uBx2wVLFnFj2RfTP0Khf2NCE=; b=Sn6ls4T/Mcq95Z01o+s9xCf/zEIVbAcwjTj51bjz36G2HWrt7J2RPV3NsnfFuZS9fd88 5nk7z9sMvC6ib3y1VPF6bCEKEHnM4ouRLDYBQOff49ojfjgsv+Xie3yYEQlQFtkB2fQ0i M8mz4OF/Ylcf3i/ZmV8i8EkwMWqOoxYPjryuQs5MmO4xilyA/UfW/qmSWCkTfVEhnR0mM 3FdgW5Tg396kZXpuc+/LVUMi9h7H5tAkVp+/hB1SD/jaMtSK+WUDeig4NsuXs7dLQHbDz Hmqnr+zluYZiDgNDa+TOrpeORkmXKnrFtWnsghffMbtY+mrqJRn/7k7VxtpOa9jJA7A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FwI2iq90; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64227606E22A; Fri, 13 Nov 2026 17:16:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=FwI2iq90 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1624C1F000C4; Fri, 13 Nov 2026 17:16:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590166; bh=47z5nEaslxCSAv1byN4uBx2wVLFnFj2RfTP0Khf2NCE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FwI2iq90RbotnbaH4oIFPaoGzrKUOBeci3oJY6YfJksmX6M/zAlqxV0Mbs3gLU08J 0vkBpX8t16aiphZdResEraBmNUw+lDGn2hLzozm0ssLc4aLMo5IlMM9FuZyDsuot14 eYBPui5T4mQH673FU90QWIZBiAAFUZuHz9ipPGEE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vega , Ido Schimmel , Naman Gulati , Zhiling Zou , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.18 176/686] ipmr: drop packets with unknown ingress VIF Date: Fri, 13 Nov 2026 10:45:09 -0500 Message-ID: <20261113153826.969928942@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhiling Zou [ Upstream commit 09280680f2ea060514be2a39ea84209fb6d721d4 ] A packet can race with VIF publication and make ipmr_find_vif() return -1 even though the VIF device pointer is already visible. The parent VIF device check can then pass with an invalid ingress VIF. For (*,G) entries, this can also let the packet be forwarded back out its ingress VIF. Drop packets whose ingress VIF lookup fails in both IPv4 and IPv6 forwarding, before checking the MFC parent device. This prevents forwarding with an unknown ingress VIF and avoids the (*,G) hairpin. Without the early check, the negative index can reach the IPv4 offload lookup only for an skb marked for L3 forwarding offload, currently done by mlxsw. The race is rare; the supplied PoC reports only the UBSAN negative-index diagnostic. Fixes: 4eadb88244d1 ("ipmr: do not acquire mrt_lock while calling ip_mr_forward()") Fixes: 9b1c21d898fd ("ip6mr: do not acquire mrt_lock while calling ip6_mr_forward()") Cc: stable@vger.kernel.org Reported-by: Vega Link: https://lore.kernel.org/netdev/b966eb102e98f299e45be59ada033a8766e4c6df.1791899747.git.zhilinz@nebusec.ai/ Suggested-by: Ido Schimmel Suggested-by: Naman Gulati Signed-off-by: Zhiling Zou Reviewed-by: Naman Gulati Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/5271fcb94a4d9e697ed64a348e92ea9e74faab1c.1792608753.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv4/ipmr.c | 3 ++- net/ipv6/ip6mr.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index f3464e7a337b6..dd9ed871a1b4f 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -2052,7 +2052,8 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt, } /* Wrong interface: drop packet and (maybe) send PIM assert. */ - if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { + if (true_vifi < 0 || + rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { if (rt_is_output_route(skb_rtable(skb))) { /* It is our own packet, looped back. * Very complicated situation... diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c index 9a2c23de98ad7..f61035619cac7 100644 --- a/net/ipv6/ip6mr.c +++ b/net/ipv6/ip6mr.c @@ -2173,7 +2173,8 @@ static void ip6_mr_forward(struct net *net, struct mr_table *mrt, /* * Wrong interface: drop packet and (maybe) send PIM assert. */ - if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { + if (true_vifi < 0 || + rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { atomic_long_inc(&c->_c.mfc_un.res.wrong_if); if (true_vifi >= 0 && mrt->mroute_do_assert && -- 2.53.0