Re: [PATCH net] ipv6: fix possible UAF in icmpv6_rcv()

Joe Damato
2026-04-16T18:10:53Z

On Thu, Apr 16, 2026 at 10:35:05AM +0000, Eric Dumazet wrote:
> Caching saddr and daddr before pskb_pull() is problematic
> since skb->head can change.
>
> Remove these temporary variables:
>
> - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr
> when net_dbg_ratelimited() is called in the slow path.
>
> - Avoid potential future misuse after pskb_pull() call.
>
> Fixes: 4b3418fba0fe ("ipv6: icmp: include addresses in debug messages")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> net/ipv6/icmp.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)

Reviewed-by: Joe Damato <joe@dama.to>