From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f53.google.com (mail-qv1-f53.google.com [209.85.219.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1EE1D3AB291 for ; Tue, 7 Jul 2026 19:32:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452781; cv=none; b=BB6fcpam7/H6NW6W9rzoymUzkAFabZYl8Abaq8ZX7IBXb7J0W4QmLTu8eDCxoX8t5lrwdA16XZIlzZXvOh3bIJNSCa7096ARnqOU1IBrSody21sinfbx5ddoQyoY8vlW2ZT55VQ0mi6D8qKdC0evGCl9Y+N/e4EaL/y2ROmyDeE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452781; c=relaxed/simple; bh=yd2mvm2aUulGdQH3BWeU+jnaQyua0wu6/xxEnxPAbic=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nKwt9zdkWaev8jEWGLU2nr7TeQzZUGIGJAEX5rUVOtF4RfP2gKuHefESMqGLegU7lDegw//mhhfUhZgRLX3+eDzCFKWwt4teY0LEOMWvpSlCGGhKesmfFu7JQvE4tQOWT5Ke9GO40UsJ+cKEMDboXwYKsKW9Uu5OJJNWLibQ32I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KJUlKArn; arc=none smtp.client-ip=209.85.219.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KJUlKArn" Received: by mail-qv1-f53.google.com with SMTP id 6a1803df08f44-8f0d6853360so31293356d6.0 for ; Tue, 07 Jul 2026 12:32:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783452779; x=1784057579; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bv2xBvquC1F5rWy3K5WDWw2YE3MQUKWYWOhGgD21Qos=; b=KJUlKArnmsyi6RUEuXr8KzWmkZ+TzAOny7DToJTnKgkKzHZc/7ZTRYuJZVSRW8IAPA Lhi74JBXHS1Qn3Ub0CdtNBsPQldXsEg8z+hZxjc8r0//+V8Kt1SJdaGkXkzbusUFQMMK 7I4yjrDWifMleuIWV51L/RKfxhCMLS9e9LtQmqsz+ypUsVjJhpdFhlENcjPnQwOHzvzH WtG/LI5t4GhaIv7NPIvvOEJS0l0wJINVMdUsu8L4YAus8zuCLZbZh2F9e8Q16C7Ih/El 1k1WZLO9jW+1FoyHI/y5u2X6+mo0KGq9cPsiZ8hYSyR7yh+nYI6Srg1iaCuHVwjoLYDv hf4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783452779; x=1784057579; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bv2xBvquC1F5rWy3K5WDWw2YE3MQUKWYWOhGgD21Qos=; b=R7o9z3AqpHBvr0fIkoMaDU4w44IM172PwIxFPvcSuQ60DtsLZm4lDV9IsFy37Dqgf4 cQ0sPf5y0kA1KyZLD/0vnvQxE6m7yAoapiLGbkNEaW13XWFsWAfJ4bgUvBaFa0SDUJkb HIffDQYChtr7foSQpqKNv+63qs46whzIUhPN/thhz5dR841Az6xivCwZZpqlH8ezbQpN qmjw6m89IEs0mqqbM50UDBOzAAaaUeGutBi9tzei5RIH+FMk5CLAlMcUIgY4LDDtWYqA yFn36TXkzy7jyWWWysfHFcoqtoC8OcV/megcKFoW9fDMzPYZh4lPMiVMTsBDch4nMdb7 +qsQ== X-Forwarded-Encrypted: i=1; AHgh+RonK6xAbynf0luOV02GPHfhUFn4jDnaksLY84HdPUOsx+r6WxME37E330BDXzfBs1D77S8b7vkBKJT495k=@vger.kernel.org X-Gm-Message-State: AOJu0YxwT7K7mxrLxTWmW9WQgScSVC4z9SUuBZDS21LELFtiaPGCTOM7 QSwWNLRqJGWL9/NeeJlCdlz7n/qEAn0+PG8JuhE6rNhJZU6Jd3V6/fp/sMondhNQidc= X-Gm-Gg: AfdE7cnkowto//DblW270tMhyHZ7UlAEKA7FVHt2CJV6MYcaLeseZOUygAw5wGF1dqq bCIskaFKsyitDiD0e+9zuqyEoP1Zg08dishf78YmQbIewIwK3ew9fAVRdxTbplTIrFe4mp/QsDp Eurv9x3YXjQFLWRqS484DVBWGOO/tRvB5XzNm+IOYZpMpeShZ0P3gPfQ6XdiPWEIGCzABMOd+uN VW6TlHn74vT5YvfEqNEj79pDc+B+G6YxeBhLqwMYHlEi5YlQ6ZIPNc1x9C0jJA8+b/H9mKDwSoD kKSI9TpGhEejbp8G2uROocOC7L8F3oXFM1juWd9uRXn93QsduWZ9hharqPIrEHHPsPkfl6+n71A 3/ryH7Hh1uqDblL+zqxeqd9gCm8Zx647vpiAtqhVMPFy4jwju6lNUfmU519mKLelT8xIG5rAT4T GOzKgJQdzdn+ORUCfK0v8ksvwUYmi3EaHXiIXplo7dl+XE66dc41kCwaIAo+37qGJ99m3OPDMBT 0BJUNUOx0BDSnvNoph8NTusztlh3+uc X-Received: by 2002:a05:6214:29c8:b0:8f0:db0e:1c28 with SMTP id 6a1803df08f44-8fcb4a06853mr84229066d6.41.1783452778600; Tue, 07 Jul 2026 12:32:58 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f4724bab15sm167767906d6.43.2026.07.07.12.32.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 12:32:58 -0700 (PDT) From: Michael Bommarito To: Taehee Yoo , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v4 2/2] amt: make the head writable before rewriting the L2 header Date: Tue, 7 Jul 2026 15:32:43 -0400 Message-ID: <20260707193243.3448201-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707193243.3448201-1-michael.bommarito@gmail.com> References: <20260707193243.3448201-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit amt_multicast_data_handler(), amt_membership_query_handler() and amt_update_handler() rewrite the ethernet header of the decapsulated skb in place (eth->h_proto, eth->h_dest and, for the query, also eth->h_source) before handing it up the stack. The skb head may be shared, for example when a packet tap has cloned it on the underlay interface, so writing through it corrupts the other reader's copy. Call skb_cow_head() before the rewrite so the head is private. It is placed before the pointers into the head are (re-)derived, so a reallocation caused by the copy is picked up by those derivations. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- drivers/net/amt.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/amt.c b/drivers/net/amt.c index 1d6b2de4b73cc..f7375e40bc8f2 100644 --- a/drivers/net/amt.c +++ b/drivers/net/amt.c @@ -2330,6 +2330,12 @@ static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb) skb_reset_mac_header(skb); skb_pull(skb, sizeof(*eth)); + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; + if (!pskb_may_pull(skb, sizeof(*iph))) return true; iph = ip_hdr(skb); @@ -2413,6 +2419,11 @@ static bool amt_membership_query_handler(struct amt_dev *amt, eth = eth_hdr(skb); /* Snapshot the outer source MAC before a later pull can free it. */ ether_addr_copy(h_source, oeth->h_source); + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; if (!pskb_may_pull(skb, sizeof(*iph))) return true; @@ -2538,6 +2549,12 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) if (!pskb_may_pull(skb, sizeof(*iph))) return true; + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; + iph = ip_hdr(skb); if (iph->version == 4) { if (ip_mc_check_igmp(skb)) { -- 2.53.0