[PATCH v2 net] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

[PATCH v2 net] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

[Eric Dumazet]

Oskar Kjos reported the following problem.

ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
value. __ip_options_echo() then reads optlen from attacker-controlled
packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).

To fix this we clear skb2->cb[], as suggested by Oskar Kjos.

Also add minimal IPv4 header validation (version == 4, ihl >= 5).

Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ido Schimmel <idosch@nvidia.com>
---
v2: dot not even try to take care of IP options.

 net/ipv6/ip6_tunnel.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4c29aa94e86eb9439458e4b23426bfda8b3b8922..0b53488a922900270903cc55840014436bd946f9 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -601,11 +601,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	if (!skb2)
 		return 0;
 
+	/* Remove debris left by IPv6 stack. */
+	memset(IPCB(skb2), 0, sizeof(*IPCB(skb2)));
+
 	skb_dst_drop(skb2);
 
 	skb_pull(skb2, offset);
 	skb_reset_network_header(skb2);
 	eiph = ip_hdr(skb2);
+	if (eiph->version != 4 || eiph->ihl < 5)
+		goto out;
 
 	/* Try to guess incoming interface */
 	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
-- 
2.53.0.1018.g2bb0e51243-goog

Re: [PATCH v2 net] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

[Ido Schimmel]

On Thu, Mar 26, 2026 at 03:51:38PM +0000, Eric Dumazet wrote:
> Oskar Kjos reported the following problem.
> 
> ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
> by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
> IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
> as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
> at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
> value. __ip_options_echo() then reads optlen from attacker-controlled
> packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
> a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
> 
> To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
> 
> Also add minimal IPv4 header validation (version == 4, ihl >= 5).
> 
> Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
> Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Ido Schimmel <idosch@nvidia.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

FWIW, I agree with the AI review [1] that we have a similar problem in
ip6_err_gen_icmpv6_unreach(): icmp6_send() being called with an IPv4
control block.

[1] https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com

Re: [PATCH v2 net] ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

[Eric Dumazet]

On Thu, Mar 26, 2026 at 12:28 PM Ido Schimmel <idosch@nvidia.com> wrote:
>
> On Thu, Mar 26, 2026 at 03:51:38PM +0000, Eric Dumazet wrote:
> > Oskar Kjos reported the following problem.
> >
> > ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
> > by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
> > IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
> > as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
> > at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
> > value. __ip_options_echo() then reads optlen from attacker-controlled
> > packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
> > a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
> >
> > To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
> >
> > Also add minimal IPv4 header validation (version == 4, ihl >= 5).
> >
> > Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
> > Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Ido Schimmel <idosch@nvidia.com>
>
> Reviewed-by: Ido Schimmel <idosch@nvidia.com>
>
> FWIW, I agree with the AI review [1] that we have a similar problem in
> ip6_err_gen_icmpv6_unreach(): icmp6_send() being called with an IPv4
> control block.
>

Indeed, thanks for noticing.

I can take care of this problem in a separate patch.

> [1] https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com