From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7111332601; Tue, 21 Apr 2026 13:16:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777399; cv=none; b=a7oxn6SHq8AKYrDgB78dfLlR/un4OAObMkbwphji9Q+pGflxFfxMqESupsL5wWKF/eSVdsX6s1eDCCuP8lHjA4cp7u04vxU/rM9oXP8+u+sleBn9Q4ghscZrpETUScJqmRPGuaHOnPcFyI6ubgCzWfMHI39gvYN7td2tuuWpU00= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776777399; c=relaxed/simple; bh=ekt9fYtNIVi9m3EuA4i7Ty2Mqhgg/HkpSTdKUOnAZVE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=h+F1RvcTTs0OujF03ZObOGqG3S+AFbIg0klyl+3lA7atN/b9Ql7+1FIni9JS3kDffdY2kWC4wMGElDok0yReg8668F31aKEU0UCu0jF4Xq311Q3SJdKgtZeDByekjbndzLy28XD1tCl9K86A89D0bWNwnV4W2P2KjWnJRyDZvD4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z/mS8NzX; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Z/mS8NzX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F289C2BCB3; Tue, 21 Apr 2026 13:16:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776777398; bh=ekt9fYtNIVi9m3EuA4i7Ty2Mqhgg/HkpSTdKUOnAZVE=; h=From:To:Cc:Subject:Date:From; b=Z/mS8NzXF7NuPFTLb/MO4Jhdoh3onaJfpkcg8C5t/tHUO609ul4CJR989EmoFqKZS 54x9DUnXkXPOwBPq5VrNeasCPQtac1CDjxApcjhxXJGuVVfpOk+a+fCc0SBY5mHiv2 Zj1yg2s23AgwbWP2oarpqcAEpOGJBgnsdXmsriuY= From: Greg Kroah-Hartman To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , "David S. Miller" , David Ahern , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , stable Subject: [PATCH net v3] ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Date: Tue, 21 Apr 2026 15:16:33 +0200 Message-ID: <2026042133-gout-unvented-1bd9@gregkh> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3632; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ekt9fYtNIVi9m3EuA4i7Ty2Mqhgg/HkpSTdKUOnAZVE=; b=owGbwMvMwCRo6H6F97bub03G02pJDJnPKzbmf0gSYaqZwbvM7PfxisSw15PTbVZen7okLWBlx u6GomPKHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjAR0ysMC1bPst+0o+X7ihdt V1mc8jOK/jEqr2KYp17O8SRXks3lIY9V78/Nytn/xdwnAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to: skb_set_mac_header(skb, -skb->mac_len); will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards. Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Cc: "David S. Miller" Cc: David Ahern Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: stable Reported-by: Anthropic Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman --- v3: - skb_postpull_rcsum() should not be changed, it's chdr NOT hdr, ugh Link to v2: https://lore.kernel.org/r/2026042158-sediment-elliptic-a954@gregkh v2: - fixed up if statement to actually work properly, and test it against a working poc (poc will be sent separately) Reworded the changelog and the subject to make more sense Link to v1: https://lore.kernel.org/r/2026042024-cabbie-gills-9371@gregkh net/ipv6/exthdrs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index 95558fd6f447..03cbce842c1a 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -491,6 +491,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) struct net *net = dev_net(skb->dev); struct inet6_dev *idev; struct ipv6hdr *oldhdr; + unsigned int chdr_len; unsigned char *buf; int accept_rpl_seg; int i, err; @@ -592,8 +593,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) skb_pull(skb, ((hdr->hdrlen + 1) << 3)); skb_postpull_rcsum(skb, oldhdr, sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3)); - if (unlikely(!hdr->segments_left)) { - if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0, + chdr_len = sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3); + if (unlikely(!hdr->segments_left || + skb_headroom(skb) < chdr_len + skb->mac_len)) { + if (pskb_expand_head(skb, chdr_len + skb->mac_len, 0, GFP_ATOMIC)) { __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS); kfree_skb(skb); @@ -603,7 +606,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) oldhdr = ipv6_hdr(skb); } - skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr)); + skb_push(skb, chdr_len); skb_reset_network_header(skb); skb_mac_header_rebuild(skb); skb_set_transport_header(skb, sizeof(struct ipv6hdr)); -- 2.53.0