Netdev List
 help / color / mirror / Atom feed
From: "Xiang Mei (Microsoft)" <xmei5@asu.edu>
To: Jakub Kicinski <kuba@kernel.org>, Taehee Yoo <ap420073@gmail.com>,
	Andrew Lunn <andrew+netdev@lunn.ch>,
	"David S . Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	AutonomousCodeSecurity@microsoft.com,
	tgopinath@linux.microsoft.com, kys@microsoft.com,
	"Xiang Mei (Microsoft)" <xmei5@asu.edu>
Subject: [PATCH net] amt: refresh cached IP header pointers after MLD/IGMP checks
Date: Fri, 10 Jul 2026 01:41:09 +0000	[thread overview]
Message-ID: <20260710014109.536177-1-xmei5@asu.edu> (raw)

amt_dev_xmit() and amt_update_handler() cache iph/ip6h before calling
ip_mc_check_igmp() / ipv6_mc_check_mld(), which may pskb_may_pull() a
non-linear skb and reallocate skb->head. The stale pointers are then
read (amt_dev_xmit: group.ip{4,6} = iph/ip6h->daddr; amt_update_handler:
ip{,v6}_eth_mc_map()), a slab-use-after-free. tx is reachable by an
unprivileged user whose amt device has SG enabled; rx by a tunnel peer
sending a membership update fragmented across several IP fragments.

Reload iph/ip6h after the check returns, like commit f0e42f0c4337
("ipv6: sit: reload inner IPv6 header after GSO offloads").

tx path:
  BUG: KASAN: slab-use-after-free in amt_dev_xmit (drivers/net/amt.c:1238)
  Read of size 16 by task exploit
   amt_dev_xmit (drivers/net/amt.c:1238)
   dev_hard_start_xmit (net/core/dev.c:3905)
   __dev_queue_xmit (net/core/dev.c:4872)
   packet_sendmsg (net/packet/af_packet.c:3114)

rx path:
  BUG: KASAN: slab-use-after-free in amt_rcv (drivers/net/amt.c:2530)
  Read of size 4 by task exploit
   amt_rcv (drivers/net/amt.c:2530)
   udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
   ip_local_deliver (net/ipv4/ip_input.c:262)
   ip_rcv (net/ipv4/ip_input.c:612)

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Fixes: bc54e49c140b ("amt: add multicast(IGMP) report message handler")
Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 drivers/net/amt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 951dd10e192b..8bc61c539b0a 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -1210,6 +1210,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 		} else {
 			data = true;
 		}
+		iph = ip_hdr(skb);
 		v6 = false;
 		group.ip4 = iph->daddr;
 #if IS_ENABLED(CONFIG_IPV6)
@@ -1234,6 +1235,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 		} else {
 			data = true;
 		}
+		ip6h = ipv6_hdr(skb);
 		v6 = true;
 		group.ip6 = ip6h->daddr;
 #endif
@@ -2498,6 +2500,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
 			netdev_dbg(amt->dev, "Invalid IGMP\n");
 			return true;
 		}
+		iph = ip_hdr(skb);
 
 		spin_lock_bh(&tunnel->lock);
 		amt_igmp_report_handler(amt, skb, tunnel);
@@ -2517,6 +2520,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
 			netdev_dbg(amt->dev, "Invalid MLD\n");
 			return true;
 		}
+		ip6h = ipv6_hdr(skb);
 
 		spin_lock_bh(&tunnel->lock);
 		amt_mld_report_handler(amt, skb, tunnel);
-- 
2.43.0


                 reply	other threads:[~2026-07-10  1:41 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260710014109.536177-1-xmei5@asu.edu \
    --to=xmei5@asu.edu \
    --cc=AutonomousCodeSecurity@microsoft.com \
    --cc=andrew+netdev@lunn.ch \
    --cc=ap420073@gmail.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=kys@microsoft.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=tgopinath@linux.microsoft.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox