From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BA5D78C9C; Sat, 12 Sep 2026 19:27:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789241235; cv=none; b=Fgoemd+mS9tgs9waGWuzKi40ZzU1jGIB2J3qoBFMmqBMveZ7rmioDkbtQQ00aHcgFiyEmfHpal0xyMpZo1sUn6zq5ww/LscYGTd9dm6BNuWRBgU4J532Zbk6Uu/RGLBLMhSa76yrRBBf7T50HkkWYd5Gjd1D1LvwtMX92BLyuCU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789241235; c=relaxed/simple; bh=169oLMvOwhMywK8NrY2fcU8GkIeASUbzS3lBGcpJ6WI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l16tdcznPt7ZtYYnBRR8/Gnt7JK0Bc/fcrr5J2u3teOd5fqRjiKz2eopaAUlNX/6JiPunRIUMGl5aohgLRBvwRraOyV3pSExlC3eKQjBdblrNBoVt0EfxrjdVdXFuuDOgzr/rgn/sX2wAuj0LCdKq+RKLWosoYR3WuG7jN+cANw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AG4WSwkC; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AG4WSwkC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E5101F000FF; Sat, 12 Sep 2026 19:27:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789241234; bh=MaeO3p3Zbdc0Y2mrzrM0e6D2GCyBF+e1wrHzZZjb5CU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AG4WSwkCr40AeT375zNO4DV5P4fjZPDvLb+d62hCg+8UNxGC92/VLRmrmbx+inpw7 pgIQ0N6tQjUYi+Blp+jC/83l8161PvwOJYV0YuW0VqMO880UW1iwZbPBROurytSNF5 lj7tf1n2C363G8/2ZHJy5q2zKTobM7WBct1GNpCE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Qing Ming , Simon Horman , Paolo Abeni Subject: [PATCH 5.10 093/798] mpls: reload header after pskb_may_pull() Date: Sat, 12 Sep 2026 08:55:21 +0200 Message-ID: <20260912065519.087948715@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065516.948645775@linuxfoundation.org> References: <20260912065516.948645775@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Qing Ming commit 29e63b8d9fc150cc191b1c6eb7e16e1247e1b650 upstream. mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again when it performs a second pull for the larger header. The issue was found through static analysis. A reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header pointer. Fixes: 9f427a0e474a ("net: mpls: Fix multipath selection for LSR use case") Cc: stable@vger.kernel.org Signed-off-by: Qing Ming Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260814095404.7205-1-a0yami@mailbox.org Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman --- net/mpls/af_mpls.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -197,6 +197,7 @@ static u32 mpls_multipath_hash(struct mp if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) { const struct iphdr *v4hdr; + hdr = mpls_hdr(skb) + label_index; v4hdr = (const struct iphdr *)(hdr + 1); if (v4hdr->version == 4) { hash = jhash_3words(ntohl(v4hdr->saddr), @@ -207,6 +208,7 @@ static u32 mpls_multipath_hash(struct mp sizeof(struct ipv6hdr))) { const struct ipv6hdr *v6hdr; + hdr = mpls_hdr(skb) + label_index; v6hdr = (const struct ipv6hdr *)(hdr + 1); hash = __ipv6_addr_jhash(&v6hdr->saddr, hash); hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);