From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f170.google.com (mail-qk1-f170.google.com [209.85.222.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC23A30D3F0 for ; Tue, 7 Jul 2026 19:32:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452778; cv=none; b=HJ8Fd5MAO3Y2s9VRuHqH+9Vug/r24rh2fso2oqXJVr36sQD1cX/5GjzIZa5nup/bh05agrMlCy81614zoVtDiNtiKDyb/7VLeg0NmCxtnTr74Iu0Y2mx8Clq5BY3P/AT3hCC4NY3qw0ul1Rc2yWGn1RKlngWXO++u3E5sqHw2J0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452778; c=relaxed/simple; bh=IFBa435MYaaMvTaZWLFDX7oNMr81k1RDEV+zPP3pf2s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=m/YzkEdxNGndYtA/tJhtSNC9kgeMkjFQpZ2xiPY5px3YMu/AzlOHWxIGF1T7xMj/wqqCPlLhhCLDWzSda3PH6NWZq6Ge47Ewx2Ad5ctnAp5usWOyBnAQnysBV9o9Fk8sv1bOrq0vYRgxDz4k50vz8PGMwAQs8Cgk44maqxT7/14= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JEnv3Wmq; arc=none smtp.client-ip=209.85.222.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JEnv3Wmq" Received: by mail-qk1-f170.google.com with SMTP id af79cd13be357-92e6c4a867cso289496985a.0 for ; Tue, 07 Jul 2026 12:32:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783452776; x=1784057576; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=PLn7G06J/yx3oS6rwfchY9PUvns0p3h3goaRA6STEhk=; b=JEnv3WmqnoJa+aty9W6PpiNFHpRJl6Br+6+2CR3mHVimAo+27h0bIcuhz4/hwTy6RK uH3XPS1oGmMW7hd/RFtfGZm1Q/qH9Nqb3h35AuscU7e9XTy5fQHanqKDWzLfwx2XdA4q MnTv0EOdB6fOveDXGqUvweOquQmrrvC2VKwbtFkYvTgqi4p2yxQtqJjMYuEaxKBjULIU 6/8y+V7C03Vw8FupbHpxvzr+ellSMFoQTVy1vHEHEsGyB2QWwiH8pIjC7gwk0mrnDle5 0qiedFJ3hD68otzIL4kDjV/yT65NGFEgh3kMPOstDlgBC1jtK7HY8TR8fLuvO2iymtJ0 xb6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783452776; x=1784057576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PLn7G06J/yx3oS6rwfchY9PUvns0p3h3goaRA6STEhk=; b=KCuLIyndiu76otfdlG8GWAcVpjORu2/7gJ4o0KJerRzDg4JpsGv/NxuwDY5dVklN0p cMnPM+/jxg+z0cGc413hP9CJebe362Fy6Yz3PC7JyMrOQh38W+51BirkSj8X0gGk6ph7 mFnGTbbnNaD9oPBY6Xf8/oF42XGvD3Kj1jckE2Ri9rUc0xQFb52YB7aAWwwpir0UEUqR FUu87nbpIvo8dS68DsOR9ZZkUgT7eHLZQDNyYtWjI0iwGI+Iwxn1ORG3H/grNtPv+lGU CtQcBmDnol2xPW7ZvTTIPsOV6GkXEr1Z85VppAnydM6NtKhrcpiPM6bhaKeITs/zF/aD 5G1A== X-Forwarded-Encrypted: i=1; AHgh+RpfYIB9We7mx2I5ojIDtnW6pqp1o8tyaKDpK9zUqnyrtnrL6WEfzgVf30doF10LIBRi2gpWxCdekr2zOhE=@vger.kernel.org X-Gm-Message-State: AOJu0YzFvfsqunuOzO+PS867PH7okOXE59P+l7Cfv3aZq481Z14laAlG 902zxm4FREk7O2pzVBKk0Tgtt8jFE4OmvhJQW6YL0nOOgtYUOKtARlpo X-Gm-Gg: AfdE7clazX+hzONti2F9encMKbBj3j/9tIrDsnFuZryMzzNJTjg2LDzefOJ2oezI2OF SfDD7/K2J098OZXEiPqUHiFS0fY7bO4V7e/RJrdZyeDD7UfZflQ2+djmyxHY77uK1IxQvk1PcEn alZI4OuRbwAQ3glVpyG26XOTYBmgnHCcqkcp2ktv35lDR2Fm+cjrarqqVRq4XhDKR7V/+DkC85V XirIoONzbguJpxSdLG6y00XRvI+CAB1CSpP0Yz7PMG1VZNl63N1JOcSoyWa6ld6ZPNRG1g8zQ1T vc3c8myRtpTnodOIPhYG9mw7CQ3ix05cr4Wrj80iCTt6IurIbe9pK600yWKU8Bnuwfl8lvQwsNM /8E29yVuKPPKDhHkEm6DfYUtxy1HCmb7g9EMbJBx7qp6aqxB1jkXWBoQEkvqQNI7FcSyeUVqAt8 Jewkyo9z0Yst/wHBLQy1el4qbuguKFli+JgV7eUHG050zTACMUhxxPoZ894G6ppCoL/tRLwTS1y BhPVPbbzXARRaCoyYMqK4rP/INmrfeJZbD9+sD23vY= X-Received: by 2002:a05:620a:4515:b0:92b:67e6:8ac4 with SMTP id af79cd13be357-92ebb70e907mr789546985a.62.1783452775458; Tue, 07 Jul 2026 12:32:55 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f4724bab15sm167767906d6.43.2026.07.07.12.32.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 12:32:54 -0700 (PDT) From: Michael Bommarito To: Taehee Yoo , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v4 0/2] amt: fix use-after-free of the skb head across pulls Date: Tue, 7 Jul 2026 15:32:41 -0400 Message-ID: <20260707193243.3448201-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Several AMT receive and transmit paths cache a pointer into the skb head and then call a helper that can reallocate that head before the cached pointer is used again, so the later access reads or writes freed memory. v3 addressed only the source-address reads in a subset of the handlers and described amt_membership_query_handler() and amt_multicast_data_handler() as unaffected. As the review pointed out, that was incomplete: those handlers keep stale eth_hdr() and AMT-header pointers across later pulls, the record loops in the IGMPv3 and MLDv2 report handlers read the record count and the group record across the *_mc_may_pull() calls, and amt_update_handler() and amt_dev_xmit() read the destination address after further pulls. Patch 1 walks every AMT path and, for each pointer used after a reallocating call, either snapshots the value before the first pull or re-derives the pointer after the last one. This uses the re-derive approach rather than the per-value snapshot of v3, because the write sites cannot be expressed as a snapshot and re-derivation is already the idiom used elsewhere in the file. Patch 2 is a smaller, separable hardening change: the three handlers that rewrite the ethernet header do so in place without making the head private, which corrupts a cloned skb (for example one held by a packet tap). It adds skb_cow_head() before the rewrite, split out so the use-after-free fix is not held up by discussion of the clone case. Both patches build cleanly (x86_64, CONFIG_AMT=m, W=1) and are checkpatch --strict clean. Changes since v3: - Rework from the per-value source-address snapshot to re-deriving the header pointers after the last reallocating pull, and cover every affected handler (amt_dev_xmit, amt_multicast_data_handler, amt_membership_query_handler, the IGMPv3 and MLDv2 record loops, and the remaining reads in amt_update_handler), not just the source-address reads. - Correct the v3 commit-message claim that the query and multicast-data handlers were unaffected. - Add patch 2 (skb_cow_head() before the L2 rewrite). - Drop the v2 Acked-by from Taehee Yoo: this series is materially larger than what was acked. v3: https://lore.kernel.org/all/20260626111917.802243-1-michael.bommarito@gmail.com/ v2: https://lore.kernel.org/all/20260617123443.3586930-1-michael.bommarito@gmail.com/ Michael Bommarito (2): amt: re-read skb header pointers after every pull amt: make the head writable before rewriting the L2 header drivers/net/amt.c | 117 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 96 insertions(+), 21 deletions(-) base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 -- 2.53.0