[PATCH net v1] udp: fix potential use-after-free in tunnel segmentation

[PATCH net v1] udp: fix potential use-after-free in tunnel segmentation

[xuanqiang.luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.

Get the UDP header after the pull to avoid a potential use-after-free.

Fixes: dbef491ebe7f ("udp: Use uh->len instead of skb->len to compute checksum in segmentation")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/ipv4/udp_offload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 29651b1a0bc70..639c59044c135 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -178,7 +178,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
 	int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
 	bool remcsum, need_csum, offload_csum, gso_partial;
 	struct sk_buff *segs = ERR_PTR(-EINVAL);
-	struct udphdr *uh = udp_hdr(skb);
+	struct udphdr *uh;
 	u16 mac_offset = skb->mac_header;
 	__be16 protocol = skb->protocol;
 	u16 mac_len = skb->mac_len;
@@ -189,6 +189,8 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
 	if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
 		goto out;
 
+	uh = udp_hdr(skb);
+
 	/* Adjust partial header checksum to negate old length.
 	 * We cannot rely on the value contained in uh->len as it is
 	 * possible that the actual value exceeds the boundaries of the
-- 
2.43.0

Re: [PATCH net v1] udp: fix potential use-after-free in tunnel segmentation

[Antoine Tenart]

On Thu, Jul 30, 2026 at 05:35:54PM +0800, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> __skb_udp_tunnel_segment() gets the UDP header before ensuring the
> tunnel header is in the skb head. If the pull reallocates skb->head,
> the saved UDP header pointer is no longer valid.
> 
> Get the UDP header after the pull to avoid a potential use-after-free.
> 
> Fixes: dbef491ebe7f ("udp: Use uh->len instead of skb->len to compute checksum in segmentation")
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Reviewed-by: Antoine Tenart <atenart@kernel.org>

> ---
>  net/ipv4/udp_offload.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
> index 29651b1a0bc70..639c59044c135 100644
> --- a/net/ipv4/udp_offload.c
> +++ b/net/ipv4/udp_offload.c
> @@ -178,7 +178,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
>  	int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
>  	bool remcsum, need_csum, offload_csum, gso_partial;
>  	struct sk_buff *segs = ERR_PTR(-EINVAL);
> -	struct udphdr *uh = udp_hdr(skb);
> +	struct udphdr *uh;
>  	u16 mac_offset = skb->mac_header;
>  	__be16 protocol = skb->protocol;
>  	u16 mac_len = skb->mac_len;
> @@ -189,6 +189,8 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
>  	if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
>  		goto out;
>  
> +	uh = udp_hdr(skb);
> +
>  	/* Adjust partial header checksum to negate old length.
>  	 * We cannot rely on the value contained in uh->len as it is
>  	 * possible that the actual value exceeds the boundaries of the
> -- 
> 2.43.0
>