Re: [PATCH v2 net] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Mar 26, 2026 at 03:51:38PM +0000, Eric Dumazet wrote:
> Oskar Kjos reported the following problem.
> 
> ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
> by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
> IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
> as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
> at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
> value. __ip_options_echo() then reads optlen from attacker-controlled
> packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
> a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
> 
> To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
> 
> Also add minimal IPv4 header validation (version == 4, ihl >= 5).
> 
> Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
> Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Ido Schimmel <idosch@nvidia.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

FWIW, I agree with the AI review [1] that we have a similar problem in
ip6_err_gen_icmpv6_unreach(): icmp6_send() being called with an IPv4
control block.

[1] https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com