From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 915DD346A1D for ; Tue, 7 Jul 2026 19:32:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452778; cv=none; b=A/BaIHrkW/ciiCpZOGCZtdRF9Zmrc4e0NKu7BnRogtuuZbB/3quMzH4Ek/cTHf86almOogRKTVNMjqMdEftX4nRhiwxjSRll7H/3w/i23p07+GvwubfedQ3XVK7RCLAOgSnWD4+DhoRs0eRzFlBS4T9/+LZTf0cw7t2sjU1nsMs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783452778; c=relaxed/simple; bh=IFBa435MYaaMvTaZWLFDX7oNMr81k1RDEV+zPP3pf2s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=m/YzkEdxNGndYtA/tJhtSNC9kgeMkjFQpZ2xiPY5px3YMu/AzlOHWxIGF1T7xMj/wqqCPlLhhCLDWzSda3PH6NWZq6Ge47Ewx2Ad5ctnAp5usWOyBnAQnysBV9o9Fk8sv1bOrq0vYRgxDz4k50vz8PGMwAQs8Cgk44maqxT7/14= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JEnv3Wmq; arc=none smtp.client-ip=209.85.222.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JEnv3Wmq" Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-92e52c9fddfso216489585a.3 for ; Tue, 07 Jul 2026 12:32:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783452776; x=1784057576; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=PLn7G06J/yx3oS6rwfchY9PUvns0p3h3goaRA6STEhk=; b=JEnv3WmqnoJa+aty9W6PpiNFHpRJl6Br+6+2CR3mHVimAo+27h0bIcuhz4/hwTy6RK uH3XPS1oGmMW7hd/RFtfGZm1Q/qH9Nqb3h35AuscU7e9XTy5fQHanqKDWzLfwx2XdA4q MnTv0EOdB6fOveDXGqUvweOquQmrrvC2VKwbtFkYvTgqi4p2yxQtqJjMYuEaxKBjULIU 6/8y+V7C03Vw8FupbHpxvzr+ellSMFoQTVy1vHEHEsGyB2QWwiH8pIjC7gwk0mrnDle5 0qiedFJ3hD68otzIL4kDjV/yT65NGFEgh3kMPOstDlgBC1jtK7HY8TR8fLuvO2iymtJ0 xb6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783452776; x=1784057576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PLn7G06J/yx3oS6rwfchY9PUvns0p3h3goaRA6STEhk=; b=tXLXIA/f5zW9UzjMxxHaUJp9Soo6/mP29+paG7PvNPtNGc8P8kyZbNIpEfWeugRbUG 7zapWF6O153ky+iZwoJ3tQEl3mS9OIlxtZDh67CY4YrfH0FSlT6lMoh00gqR+8aL/rJ5 6pSsKaxrmtY4N5DPLmn0FUIuT7CdKowFce4oIVikyG2VmcVOx1pge6G3eTLTXATJbkGm DLx6dK0mNdrgTGaAJ3CoVa7X5j6b7wM+rtplGouC3yBx0ch0ZVDomj+Umqj2ZDzlG1gJ JATtB1x5odEorwgr5t/DJPMVmJuiwWo6ZOdPEUYRRY12z+CfPY0vN67tSoY+Ne9V4JN2 7j+Q== X-Gm-Message-State: AOJu0Yx73LZHEg/UmDJMrkA/9KavHHEIplQHOmpFF7fUpJLma1TRGtJu q5kLYwOWb2Y7bjhIN5JtdYWGnztGRsGETVYsmRRiL/i5YafvvPuZEXME X-Gm-Gg: AfdE7ckNZiKVo44DmUmTOWCqz/uVO+LfZ15FexasoMYB27rKolULW/wwdxLWPLXmBD6 rBl1vr+wISS6x6+2lrtc6ANMcTBPDzgigIA82NrLMeGvja3DYVeA9LdLrS98vyQNEDSUEJb6Wfx RxK32mSNCcMXhOUGt+5dcgbG5k51qQv4J9Yb8mQnb5uvrqcgfXe50x66sm2YkDkcx8iqcBua83X Rvqp/tPVHVpVYZnnFx7pBEUfIcqbvOAQJOzp8kW/8LEWdZtcPVRpcxQtbLMuK/mcjujpWB7gcrX U/NjaKbtFKhuHymCcaQEOY3+YLb4N33W1PWR6KnkoO2R7SKGhniSUHz62JVsoDxR++Y4qb4ppvr ru2L7hL8I6IaOrovhgO+SYyx+GUyjnZP/xmGZ4PN880JPCNpLbMNDkENqUKwd8EqtS/O9tUMhJq 7UDMLvuTcwDWpngBq0+wtSlhBUXz1fNyheKp7Kkc0C0R8dBA/Da23uWKK9nkump9HF2tBrLvrD8 6haa6UDjNMCJJHmDj+tijhxxNcIPVU+jG6Olah3akc= X-Received: by 2002:a05:620a:4515:b0:92b:67e6:8ac4 with SMTP id af79cd13be357-92ebb70e907mr789546985a.62.1783452775458; Tue, 07 Jul 2026 12:32:55 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f4724bab15sm167767906d6.43.2026.07.07.12.32.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 12:32:54 -0700 (PDT) From: Michael Bommarito To: Taehee Yoo , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v4 0/2] amt: fix use-after-free of the skb head across pulls Date: Tue, 7 Jul 2026 15:32:41 -0400 Message-ID: <20260707193243.3448201-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Several AMT receive and transmit paths cache a pointer into the skb head and then call a helper that can reallocate that head before the cached pointer is used again, so the later access reads or writes freed memory. v3 addressed only the source-address reads in a subset of the handlers and described amt_membership_query_handler() and amt_multicast_data_handler() as unaffected. As the review pointed out, that was incomplete: those handlers keep stale eth_hdr() and AMT-header pointers across later pulls, the record loops in the IGMPv3 and MLDv2 report handlers read the record count and the group record across the *_mc_may_pull() calls, and amt_update_handler() and amt_dev_xmit() read the destination address after further pulls. Patch 1 walks every AMT path and, for each pointer used after a reallocating call, either snapshots the value before the first pull or re-derives the pointer after the last one. This uses the re-derive approach rather than the per-value snapshot of v3, because the write sites cannot be expressed as a snapshot and re-derivation is already the idiom used elsewhere in the file. Patch 2 is a smaller, separable hardening change: the three handlers that rewrite the ethernet header do so in place without making the head private, which corrupts a cloned skb (for example one held by a packet tap). It adds skb_cow_head() before the rewrite, split out so the use-after-free fix is not held up by discussion of the clone case. Both patches build cleanly (x86_64, CONFIG_AMT=m, W=1) and are checkpatch --strict clean. Changes since v3: - Rework from the per-value source-address snapshot to re-deriving the header pointers after the last reallocating pull, and cover every affected handler (amt_dev_xmit, amt_multicast_data_handler, amt_membership_query_handler, the IGMPv3 and MLDv2 record loops, and the remaining reads in amt_update_handler), not just the source-address reads. - Correct the v3 commit-message claim that the query and multicast-data handlers were unaffected. - Add patch 2 (skb_cow_head() before the L2 rewrite). - Drop the v2 Acked-by from Taehee Yoo: this series is materially larger than what was acked. v3: https://lore.kernel.org/all/20260626111917.802243-1-michael.bommarito@gmail.com/ v2: https://lore.kernel.org/all/20260617123443.3586930-1-michael.bommarito@gmail.com/ Michael Bommarito (2): amt: re-read skb header pointers after every pull amt: make the head writable before rewriting the L2 header drivers/net/amt.c | 117 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 96 insertions(+), 21 deletions(-) base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 -- 2.53.0