[PATCH] ipv4: icmp: use skb_dst_dev_net_rcu() in icmp_build_probe

[PATCH] ipv4: icmp: use skb_dst_dev_net_rcu() in icmp_build_probe

[Haoran Wang]

icmp_build_probe() derives the network namespace from the ingress device.

    /* net/ipv4/icmp.c:1296 */
    struct net *net = dev_net_rcu(skb->dev);

The ICMP Extended Echo (RFC 8335) PROBE replies identify the queried
interface by name/index/address and should look it up and apply policy
in the netns the packet is destined to, not the netns of the ingress
device.  Under a VRF, skb->dev is the VRF master, so dev_net_rcu(skb->dev)
returns the master's netns and the device lookup / reply policy run in
the wrong namespace.

The rest of the IPv4 ICMP echo path already uses skb_dst_dev_net_rcu(skb)
(net/ipv4/icmp.c:1123, :1267, :1437), while icmp_build_probe() is the
exception.


Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
---
 net/ipv4/icmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 90c0e22c2..a577dfc65 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1293,7 +1293,7 @@ static enum skb_drop_reason icmp_echo(struct sk_buff *skb)
 
 bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 {
-	struct net *net = dev_net_rcu(skb->dev);
+	struct net *net = skb_dst_dev_net_rcu(skb);
 	struct icmp_ext_hdr *ext_hdr, _ext_hdr;
 	struct icmp_ext_echo_iio *iio, _iio;
 	struct inet6_dev *in6_dev;

Re: [PATCH] ipv4: icmp: use skb_dst_dev_net_rcu() in icmp_build_probe

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.