From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26CDA35292A; Tue, 16 Jun 2026 18:20:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634018; cv=none; b=Ghc56XeOXkL+3fRHVIN1Ii32t5yzQ8wlAio0Sjq9DeccOJhiBOHz1U791Rc129IBtzrOyi8iXblUumrnPxQiLZO0E4ik6/V/ZJBWIIiYveo0gGXd729QotfN/7LWAG+dMJ487HhJvPWg6WFvsnj2+g3xVC9E/aQ4yOYu9yjL6TQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634018; c=relaxed/simple; bh=H8ssRX0pJp6d7TLdF5Dn3k5OIZ8r5m6SpZs6E/ra3eI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KFONF/2n8YkmVDem5mrjz1Vmu2vKM8SQr/65BVraUuH+Y0fXYb/V2kVZwrEn77J07or6zcv1icvngyqGe5ffQdO0shHD3r4e5/q7KYD9wuxzlk6eVdyxKPbiMz8JqTTVJqZxWTi3cOtn9/Ci3cA3RhOjoohlVwLFzJltszNyqvU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dS308HPB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dS308HPB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 362271F000E9; Tue, 16 Jun 2026 18:20:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781634017; bh=05m8WQq5tCOTbxC/HMf6umqKxZHNWAwIVxiVFJtEjMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dS308HPBxEzmsqrjtNML+JM2sIMhzvySM1jijwRKcFbBmBscKmGX7+A7O7zd4aXiF 9GOQIx7UVp/riISSypxS7+ccRuGnxBqKp0XswOie959VLOrBPKLz2rKNWW1O76HW+s 1nEBaua9tx6kQsrHqn2JqF0EmANoSvm8JHrekgQs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kyle Zeng , Eric Dumazet , syzbot+6eb9ca986d80f6f88cf9@syzkaller.appspotmail.com, Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 185/411] ipv6: sit: reload inner IPv6 header after GSO offloads Date: Tue, 16 Jun 2026 20:27:03 +0530 Message-ID: <20260616145110.532954104@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145100.376842714@linuxfoundation.org> References: <20260616145100.376842714@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kyle Zeng [ Upstream commit f0e42f0c4337b1f220de1ddd63f47197c7dee4de ] ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb. Fixes: 14909664e4e1 ("sit: Setup and TX path for sit/UDP foo-over-udp encapsulation") Signed-off-by: Kyle Zeng Reviewed-by: Eric Dumazet Reported-by: syzbot+6eb9ca986d80f6f88cf9@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260605073448.6524-1-kylebot@openai.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv6/sit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 3bc02ab9ceaca0..bc5db4a9dbfaf1 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -971,6 +971,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, ip_rt_put(rt); goto tx_error; } + iph6 = ipv6_hdr(skb); if (df) { mtu = dst_mtu(&rt->dst) - t_hlen; -- 2.53.0