Re: [PATCH net v2] ila: reload IPv6 header after pskb_may_pull in checksum adjust

[Antoine Tenart <atenart@kernel.org>]

On Tue, Jul 14, 2026 at 07:49:03AM -0400, Michael Bommarito wrote:
> ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling
> pskb_may_pull(). On a non-linear skb whose transport header sits in a page
> fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head()
> and free the old skb head, leaving ip6h dangling; the following
> get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()
> uses ip6h (and the iaddr derived from it) again after the csum-adjust
> call and additionally writes the new locator through that pointer.
> 
> Impact: a remote IPv6 packet routed through a configured ILA
> csum-adjust-transport route or receive-side mapping triggers a
> slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or
> mapping requires CAP_NET_ADMIN to configure, but trigger packets are
> unauthenticated once it exists.
> 
> Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()
> before the csum-diff read. In ila_update_ipv6_locator() only the
> ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in
> that case alone before the destination-address write; the neutral-map
> modes never pull and keep their cached pointers.
> 
> Fixes: 33f11d16142b ("ila: Create net/ipv6/ila directory")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>

Reviewed-by: Antoine Tenart <atenart@kernel.org>

Thanks!
Antoine

> ---
> v2: In ila_update_ipv6_locator() reload ip6h/iaddr only in the
>     ILA_CSUM_ADJUST_TRANSPORT case instead of unconditionally, per
>     Antoine Tenart's review; the neutral-map modes never pull the skb,
>     so their cached pointers remain valid.
> v1: https://lore.kernel.org/netdev/20260711150648.2915106-1-michael.bommarito@gmail.com/
> 
> Evidence: a KUnit case on UML+KASAN drives ila_update_ipv6_locator()
> with a non-linear skb whose transport header sits in a fragment, so the
> pskb_may_pull() in ila_csum_adjust_transport() reallocates the head.
> Stock: BUG: KASAN: slab-use-after-free in ila_update_ipv6_locator, Read of
> size 4 (the stale ip6h/iaddr). Patched: both the valid-linear control and
> the fragmented case pass, KASAN-clean. Built clean, no new warnings.
> 
> 
>  net/ipv6/ila/ila_common.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/net/ipv6/ila/ila_common.c b/net/ipv6/ila/ila_common.c
> index e71571455c8a0..b78179bfc4c72 100644
> --- a/net/ipv6/ila/ila_common.c
> +++ b/net/ipv6/ila/ila_common.c
> @@ -85,6 +85,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb,
>  			struct tcphdr *th = (struct tcphdr *)
>  					(skb_network_header(skb) + nhoff);
>  
> +			ip6h = ipv6_hdr(skb);
>  			diff = get_csum_diff(ip6h, p);
>  			inet_proto_csum_replace_by_diff(&th->check, skb,
>  							diff, true, true);
> @@ -96,6 +97,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb,
>  					(skb_network_header(skb) + nhoff);
>  
>  			if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
> +				ip6h = ipv6_hdr(skb);
>  				diff = get_csum_diff(ip6h, p);
>  				inet_proto_csum_replace_by_diff(&uh->check, skb,
>  								diff, true, true);
> @@ -110,6 +112,7 @@ static void ila_csum_adjust_transport(struct sk_buff *skb,
>  			struct icmp6hdr *ih = (struct icmp6hdr *)
>  					(skb_network_header(skb) + nhoff);
>  
> +			ip6h = ipv6_hdr(skb);
>  			diff = get_csum_diff(ip6h, p);
>  			inet_proto_csum_replace_by_diff(&ih->icmp6_cksum, skb,
>  							diff, true, true);
> @@ -127,6 +130,15 @@ void ila_update_ipv6_locator(struct sk_buff *skb, struct ila_params *p,
>  	switch (p->csum_mode) {
>  	case ILA_CSUM_ADJUST_TRANSPORT:
>  		ila_csum_adjust_transport(skb, p);
> +		/*
> +		 * ila_csum_adjust_transport() calls pskb_may_pull(), which can
> +		 * reallocate the skb head and leave ip6h (and the iaddr derived
> +		 * from it) dangling; reload both before the write below.  The
> +		 * other csum modes do not pull, so their cached pointers stay
> +		 * valid.
> +		 */
> +		ip6h = ipv6_hdr(skb);
> +		iaddr = ila_a2i(&ip6h->daddr);
>  		break;
>  	case ILA_CSUM_NEUTRAL_MAP:
>  		if (sir2ila) {
> -- 
> 2.53.0
>