* [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
@ 2026-05-05 13:00 Eric Dumazet
2026-05-05 20:37 ` David Ahern
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Eric Dumazet @ 2026-05-05 13:00 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, David Ahern, netdev, eric.dumazet,
Eric Dumazet, Damiano Melotti
ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.
Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.
Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/ipv6/ip6_output.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7e92909ab5be3f86b10bf9527e97f3bfe794e9e9..aee91ba04130527ceb19881dc1e7232a5d2c8580 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -468,6 +468,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
default:
break;
}
+ hdr = ipv6_hdr(skb);
}
/*
@@ -582,6 +583,8 @@ int ip6_forward(struct sk_buff *skb)
if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {
int proxied = ip6_forward_proxy_check(skb);
+
+ hdr = ipv6_hdr(skb);
if (proxied > 0) {
/* It's tempting to decrease the hop limit
* here by 1, as we do at the end of the
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
@ 2026-05-05 20:37 ` David Ahern
2026-05-06 11:10 ` Ido Schimmel
2026-05-07 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: David Ahern @ 2026-05-05 20:37 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, netdev, eric.dumazet, Damiano Melotti
On 5/5/26 7:00 AM, Eric Dumazet wrote:
> ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
> skb->head.
>
> Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
> the freed memory.
>
> Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
> Reported-by: Damiano Melotti <melotti@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> net/ipv6/ip6_output.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
2026-05-05 20:37 ` David Ahern
@ 2026-05-06 11:10 ` Ido Schimmel
2026-05-07 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Ido Schimmel @ 2026-05-06 11:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
David Ahern, netdev, eric.dumazet, Damiano Melotti
On Tue, May 05, 2026 at 01:00:56PM +0000, Eric Dumazet wrote:
> ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
> skb->head.
>
> Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
> the freed memory.
>
> Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
> Reported-by: Damiano Melotti <melotti@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
2026-05-05 20:37 ` David Ahern
2026-05-06 11:10 ` Ido Schimmel
@ 2026-05-07 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-05-07 0:40 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, idosch, dsahern, netdev, eric.dumazet,
melotti
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 5 May 2026 13:00:56 +0000 you wrote:
> ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
> skb->head.
>
> Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
> the freed memory.
>
> Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
> Reported-by: Damiano Melotti <melotti@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
>
> [...]
Here is the summary with links:
- [net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
https://git.kernel.org/netdev/net/c/7aaa8f5e45a9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-05-07 0:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
2026-05-05 20:37 ` David Ahern
2026-05-06 11:10 ` Ido Schimmel
2026-05-07 0:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox