Re: [PATCH net 1/2] ipv4: unshare headers before recompiling IP options in ipv4_send_dest_unreach()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] ipv4: dangling header pointers in ip_tunnel_xmit() after
  skb_unclone()
--

commit b978ee14726a511c1195a618445671504ee53c90
Author: Eric Dumazet <edumazet@kernel.org>

ipv4: unshare headers before recompiling IP options in ipv4_send_dest_unreach()

This commit calls skb_unclone() in ipv4_send_dest_unreach() before
recompiling IPv4 options so that in-place option updates do not race on
shared packet headers.

> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 3a90c8d28b940..4d8fcc95c2f46 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -1269,7 +1269,8 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb)
>  
>  	memset(&parm, 0, sizeof(parm));
>  	if (ip_hdr(skb)->ihl > 5) {
> -		if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
> +		if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4) ||
> +		    skb_unclone(skb, GFP_ATOMIC))
>  			return;
>  		parm.opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);

[Severity: High]
Can calling skb_unclone() here leave dangling header pointers in callers of
dst_link_failure()?

ip_tunnel_xmit() caches inner_iph into skb->head before calling
dst_link_failure() -> ipv4_link_failure() -> ipv4_send_dest_unreach(), and
only calls skb_cow_head() afterwards:

net/ipv4/ip_tunnel.c:ip_tunnel_xmit() {
	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
	...
			dst_link_failure(skb);
		} else {
			WRITE_ONCE(tunnel->err_count, 0);
		}
	}

	tos = ip_tunnel_ecn_encap(tos, inner_iph, skb);
	ttl = tnl_params->ttl;
	if (ttl == 0) {
		if (payload_protocol == htons(ETH_P_IP))
			ttl = inner_iph->ttl;
}

When a cloned linear skb with IPv4 options (such as a TCP packet or a
TC-mirred clone transmitted over IPIP, SIT, or NBMA GRE while
tunnel->err_count > 0) hits dst_link_failure(), skb_unclone() reallocates
skb->head via pskb_expand_head() and drops the reference to the old buffer.
After dst_link_failure() returns, ip_tunnel_xmit() dereferences the stale
inner_iph (and tnl_params from ipgre_xmit()), causing a use-after-free read
if the other clone was freed.  A similar pattern exists in
ipip6_tunnel_xmit() with iph6 when skb_unclone() clears skb_cloned(skb) and
causes the skb_realloc_headroom() branch to be skipped.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106234313.2537882-1-edumazet@kernel.org?part=1