Re: [PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom

[Paolo Abeni <pabeni@redhat.com>]

On 9/18/26 03:28, Yuya Kusakabe wrote:
> The seg6, ioam6 and rpl lwtunnels all grow the headroom with
> skb_cow_head(), push their new headers into it, and then rebuild the mac
> header below them with skb_mac_header_rebuild().  The headroom left
> after the push has to be at least skb->mac_len for that rebuild, but the
> requests ask for the pushed length plus dst_dev_overhead(), which leaves
> LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet.
> 
> Where the mac header is longer than that, as it is on ingress through a
> VLAN device with reorder_hdr off, the rebuild runs out of room:
> skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,
> stores it unchecked in the u16 skb->mac_header, and the memmove that
> follows writes skb->mac_len bytes about 64 KB past skb->head.
> Forwarding plain ping6 traffic through such a device reproduces it on
> all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;
> skb->mac_header comes back as 65534 on a 704-byte head.
> 
> Ask for whichever of the two is larger.  These requests carried
> skb->mac_len until the egress overhead took its place rather than
> joining it.
> 
> Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue")
> Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue")
> Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue")
> Assisted-by: LLM
> Signed-off-by: Yuya Kusakabe <yuya.kusakabe@gmail.com>
> Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
> ---
> Changes in v2:
> - Use max_t(unsigned int, ...) rather than max() [Justin]
> - Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin]
> - Reproduce and verify the fix on those two as well: unpatched, rpl
>    underflows in 12 of 16 probed configurations and ioam6 in 3 of 13,
>    both reaching about 64 KB past a 320-byte head; patched, neither
>    underflows in 18
> - Rewrap the requests so they no longer exceed 80 columns
> - Retitle for net: ipv6, now that the change spans three files
> - Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-02ccec50f096@gmail.com
> ---
>   net/ipv6/ioam6_iptunnel.c |  8 ++++++--
>   net/ipv6/rpl_iptunnel.c   |  4 +++-
>   net/ipv6/seg6_iptunnel.c  | 12 +++++++++---
>   3 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
> index cfb2c41634a0..4fc745f78eaf 100644
> --- a/net/ipv6/ioam6_iptunnel.c
> +++ b/net/ipv6/ioam6_iptunnel.c
> @@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
>   
>   	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
>   
> -	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
> +	err = skb_cow_head(skb, hdrlen +
> +			   max_t(unsigned int, skb->mac_len,
> +				 dst_dev_overhead(cache_dst, skb)));

The above snipped is repeated 6 times verbatim: it's calling loudly for
some deduplication.

Since all the existing dst_dev_overhead() users are touched here, I
suggest moving the max() computation inside dst_dev_overhead().

/P