[PATCH net] ipv6: ioam: refresh hdr pointer before ioam6_event()

[PATCH net] ipv6: ioam: refresh hdr pointer before ioam6_event()

[Justin Iurman]

Reported by Sashiko:

In ipv6_hop_ioam(), the hdr pointer is initialized to point into the
skb's linear data buffer. Later, the code calls skb_ensure_writable(),
which might reallocate the buffer:

	if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))
		goto drop;

	/* Trace pointer may have changed */
	trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
					   + optoff + sizeof(*hdr));

	ioam6_fill_trace_data(skb, ns, trace, true);

	ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev),
		    GFP_ATOMIC, (void *)trace, hdr->opt_len - 2);

If the skb is cloned or lacks sufficient linear headroom,
skb_ensure_writable() will invoke pskb_expand_head(), which reallocates
the skb's data buffer and frees the old one, invalidating pointers to
it. While the code recalculates the trace pointer immediately after the
call to skb_ensure_writable(), it fails to recalculate the hdr pointer.

This patch fixes the above by recalculating the hdr pointer before
passing hdr->opt_len to ioam6_event(), so that we avoid any UaF.

Fixes: f655c78d6225 ("net: exthdrs: ioam6: send trace event")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
---
 net/ipv6/exthdrs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 47c5502a34a2..2f991c974395 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -967,8 +967,8 @@ static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)
 			goto drop;
 
 		/* Trace pointer may have changed */
-		trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
-						   + optoff + sizeof(*hdr));
+		hdr = (struct ioam6_hdr *)(skb_network_header(skb) + optoff);
+		trace = (struct ioam6_trace_hdr *)((u8 *)hdr + sizeof(*hdr));
 
 		ioam6_fill_trace_data(skb, ns, trace, true);
 
-- 
2.34.1

Re: [PATCH net] ipv6: ioam: refresh hdr pointer before ioam6_event()

[Ido Schimmel]

On Wed, May 20, 2026 at 02:42:42PM +0200, Justin Iurman wrote:
> Reported by Sashiko:
> 
> In ipv6_hop_ioam(), the hdr pointer is initialized to point into the
> skb's linear data buffer. Later, the code calls skb_ensure_writable(),
> which might reallocate the buffer:
> 
> 	if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))
> 		goto drop;
> 
> 	/* Trace pointer may have changed */
> 	trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
> 					   + optoff + sizeof(*hdr));
> 
> 	ioam6_fill_trace_data(skb, ns, trace, true);
> 
> 	ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev),
> 		    GFP_ATOMIC, (void *)trace, hdr->opt_len - 2);
> 
> If the skb is cloned or lacks sufficient linear headroom,
> skb_ensure_writable() will invoke pskb_expand_head(), which reallocates
> the skb's data buffer and frees the old one, invalidating pointers to
> it. While the code recalculates the trace pointer immediately after the
> call to skb_ensure_writable(), it fails to recalculate the hdr pointer.
> 
> This patch fixes the above by recalculating the hdr pointer before
> passing hdr->opt_len to ioam6_event(), so that we avoid any UaF.
> 
> Fixes: f655c78d6225 ("net: exthdrs: ioam6: send trace event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Justin Iurman <justin.iurman@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

> ---
>  net/ipv6/exthdrs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 47c5502a34a2..2f991c974395 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -967,8 +967,8 @@ static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)
>  			goto drop;
>  
>  		/* Trace pointer may have changed */

If you need v2: /* Trace and hdr pointers may have changed */

> -		trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
> -						   + optoff + sizeof(*hdr));
> +		hdr = (struct ioam6_hdr *)(skb_network_header(skb) + optoff);
> +		trace = (struct ioam6_trace_hdr *)((u8 *)hdr + sizeof(*hdr));
>  
>  		ioam6_fill_trace_data(skb, ns, trace, true);
>  
> -- 
> 2.34.1
>