[PATCH ipsec] xfrm6: gate the local error on the frame's own socket

[Rustam Mustafin <rmustafin@cloudlinux.com>]

__xfrm6_output() decides to report a too big frame as a local error by
looking at its sk argument, but xfrm_local_error() reports to skb->sk
and dereferences it unchecked.  The two differ for a UDP tunnel: vxlan,
geneve and other udp_tunnel6_xmit_skb() users pass the tunnel socket as
sk, while a frame they forward has no skb->sk.  When such a frame takes
an IPv6 tunnel mode xfrm bundle and exceeds its MTU, xfrm_local_error()
oopses on skb->sk->sk_family in softirq context:

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:xfrm_local_error+0x92/0x190
  Call Trace:
   <IRQ>
   xfrm6_output+0x599/0xae0
   udp_tunnel6_xmit_skb+0x713/0xd90
   vxlan_xmit_one+0x1ebc/0x3490
   vxlan_xmit+0x1369/0x6540
   dev_hard_start_xmit+0xe3/0x5b0
   __dev_queue_xmit+0x18e7/0x3550
   ip6_output+0x360/0xec0
   ip6_forward+0x1573/0x35c0

Commit 1620c88887b1 ("xfrm: Fix the usage of skb->sk") changed this
test from skb->sk to sk.  Test skb_to_full_sk(skb) instead, as
xfrm6_tunnel_check_size() already does; commit 6973a21ee73c
("ipv6: xfrm: use full sockets in local error paths") made the IPv6
callees use full sockets the same way.

A frame without a socket then goes to ip6_fragment(), which sends an
ICMPv6 Packet Too Big to the source address of the outer header, the
local tunnel endpoint, and drops the frame, as before 1620c88887b1.  A
caller that passes a NULL sk while skb->sk is set, such as
ip6tunnel_xmit(NULL, ...) in ip6_tunnel.c, takes the local error path
again, also as before that commit.

Fixes: 1620c88887b1 ("xfrm: Fix the usage of skb->sk")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Rustam Mustafin <rmustafin@cloudlinux.com>
---

Notes:
    Tested in virtme-ng on 7e1392a42ea2 (v7.4-rc2+) with KASAN: vxlan over
    an IPv6 ESP tunnel, a forwarded frame above the bundle MTU.
    Unpatched: the oops above.
    Patched: no oops in 3 runs.  A separate run with nstat in the
    forwarding netns shows Ip6FragFails 0->2, Icmp6OutPktTooBigs 0->2 and
    Ip6FragCreates 0->0.
    The reproducer script is available on request.
    
    Not changed here:
    - The xfrm6_local_dontfrag(sk) test in the same function still uses the
      argument.  Its callee xfrm6_local_rxpmtu() returns on a NULL skb->sk
      since 6973a21ee73c, so that mismatch does not oops.
    - iptfs_is_too_big() has the same sk vs skb->sk mismatch (IPv6 oops,
      IPv4 silent drop).  It is left for a separate patch; it was already
      pointed out in two reviews:
      https://lore.kernel.org/r/20260908224856.1591189-1-kuba@kernel.org
      https://lore.kernel.org/r/179369310739.488856.16665150928122536725@kernel.org

 net/ipv6/xfrm6_output.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 44b221a09a0c..54fcf4b43091 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -95,7 +95,10 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 	} else if (toobig && xfrm6_noneed_fragment(skb)) {
 		skb->ignore_df = 1;
 		goto skip_frag;
-	} else if (!skb->ignore_df && toobig && sk) {
+	} else if (!skb->ignore_df && toobig && skb_to_full_sk(skb)) {
+		/* xfrm_local_error() reports to skb->sk; a forwarded frame
+		 * sent through a UDP tunnel has none, sk is the tunnel's.
+		 */
 		xfrm_local_error(skb, mtu);
 		kfree_skb(skb);
 		return -EMSGSIZE;

base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
-- 
2.52.0