[PATCH] ipv6: sit: reload inner IPv6 header after GSO offloads

[PATCH] ipv6: sit: reload inner IPv6 header after GSO offloads

[Kyle Zeng]

ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
entry and continues using it after iptunnel_handle_offloads().

For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
When the skb header is cloned, skb_header_unclone() can call
pskb_expand_head(), which may move the skb head. The pskb_expand_head()
contract requires pointers into the skb header to be reloaded after the
call.

If the later skb_realloc_headroom() branch is not taken, SIT uses the
stale iph6 pointer to read the inner hop limit and DS field. That can
read from a freed skb head after the old head's remaining clone is
released.

Reload iph6 after the offload helper succeeds and before subsequent
reads from the inner IPv6 header. Keep the existing reload after
skb_realloc_headroom(), since that branch can also replace the skb.

Fixes: 14909664e4e1 ("sit: Setup and TX path for sit/UDP foo-over-udp encapsulation")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/ipv6/sit.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07d416df93ed..ef8705093472 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -961,6 +961,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 		ip_rt_put(rt);
 		goto tx_error;
 	}
+	iph6 = ipv6_hdr(skb);
 
 	if (df) {
 		mtu = dst4_mtu(&rt->dst) - t_hlen;
-- 
2.49.0

Re: [PATCH] ipv6: sit: reload inner IPv6 header after GSO offloads

[Eric Dumazet]

On Fri, Jun 5, 2026 at 12:34 AM Kyle Zeng <kylebot@openai.com> wrote:
>
> ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
> entry and continues using it after iptunnel_handle_offloads().
>
> For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
> When the skb header is cloned, skb_header_unclone() can call
> pskb_expand_head(), which may move the skb head. The pskb_expand_head()
> contract requires pointers into the skb header to be reloaded after the
> call.
>
> If the later skb_realloc_headroom() branch is not taken, SIT uses the
> stale iph6 pointer to read the inner hop limit and DS field. That can
> read from a freed skb head after the old head's remaining clone is
> released.
>
> Reload iph6 after the offload helper succeeds and before subsequent
> reads from the inner IPv6 header. Keep the existing reload after
> skb_realloc_headroom(), since that branch can also replace the skb.
>
> Fixes: 14909664e4e1 ("sit: Setup and TX path for sit/UDP foo-over-udp encapsulation")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---

Reviewed-by: Eric Dumazet <edumazet@google.com>

syzbot found the issue lately as well.

Reported-by: syzbot+6eb9ca986d80f6f88cf9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2510bc.39669fcc.33b062.000c.GAE@google.com/T/#u

Re: [PATCH] ipv6: sit: reload inner IPv6 header after GSO offloads

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  5 Jun 2026 00:34:48 -0700 you wrote:
> ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
> entry and continues using it after iptunnel_handle_offloads().
> 
> For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
> When the skb header is cloned, skb_header_unclone() can call
> pskb_expand_head(), which may move the skb head. The pskb_expand_head()
> contract requires pointers into the skb header to be reloaded after the
> call.
> 
> [...]

Here is the summary with links:
  - ipv6: sit: reload inner IPv6 header after GSO offloads
    https://git.kernel.org/netdev/net/c/f0e42f0c4337

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html