From: "Xiang Mei (Microsoft)" <xmei5@asu.edu>
To: Jakub Kicinski <kuba@kernel.org>, Taehee Yoo <ap420073@gmail.com>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
AutonomousCodeSecurity@microsoft.com,
tgopinath@linux.microsoft.com, kys@microsoft.com,
"Xiang Mei (Microsoft)" <xmei5@asu.edu>
Subject: [PATCH net] amt: refresh cached IP header pointers after MLD/IGMP checks
Date: Fri, 10 Jul 2026 01:41:09 +0000 [thread overview]
Message-ID: <20260710014109.536177-1-xmei5@asu.edu> (raw)
amt_dev_xmit() and amt_update_handler() cache iph/ip6h before calling
ip_mc_check_igmp() / ipv6_mc_check_mld(), which may pskb_may_pull() a
non-linear skb and reallocate skb->head. The stale pointers are then
read (amt_dev_xmit: group.ip{4,6} = iph/ip6h->daddr; amt_update_handler:
ip{,v6}_eth_mc_map()), a slab-use-after-free. tx is reachable by an
unprivileged user whose amt device has SG enabled; rx by a tunnel peer
sending a membership update fragmented across several IP fragments.
Reload iph/ip6h after the check returns, like commit f0e42f0c4337
("ipv6: sit: reload inner IPv6 header after GSO offloads").
tx path:
BUG: KASAN: slab-use-after-free in amt_dev_xmit (drivers/net/amt.c:1238)
Read of size 16 by task exploit
amt_dev_xmit (drivers/net/amt.c:1238)
dev_hard_start_xmit (net/core/dev.c:3905)
__dev_queue_xmit (net/core/dev.c:4872)
packet_sendmsg (net/packet/af_packet.c:3114)
rx path:
BUG: KASAN: slab-use-after-free in amt_rcv (drivers/net/amt.c:2530)
Read of size 4 by task exploit
amt_rcv (drivers/net/amt.c:2530)
udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
ip_local_deliver (net/ipv4/ip_input.c:262)
ip_rcv (net/ipv4/ip_input.c:612)
Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Fixes: bc54e49c140b ("amt: add multicast(IGMP) report message handler")
Fixes: b75f7095d4d4 ("amt: add mld report message handler")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
drivers/net/amt.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 951dd10e192b..8bc61c539b0a 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -1210,6 +1210,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
data = true;
}
+ iph = ip_hdr(skb);
v6 = false;
group.ip4 = iph->daddr;
#if IS_ENABLED(CONFIG_IPV6)
@@ -1234,6 +1235,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
data = true;
}
+ ip6h = ipv6_hdr(skb);
v6 = true;
group.ip6 = ip6h->daddr;
#endif
@@ -2498,6 +2500,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
netdev_dbg(amt->dev, "Invalid IGMP\n");
return true;
}
+ iph = ip_hdr(skb);
spin_lock_bh(&tunnel->lock);
amt_igmp_report_handler(amt, skb, tunnel);
@@ -2517,6 +2520,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
netdev_dbg(amt->dev, "Invalid MLD\n");
return true;
}
+ ip6h = ipv6_hdr(skb);
spin_lock_bh(&tunnel->lock);
amt_mld_report_handler(amt, skb, tunnel);
--
2.43.0
reply other threads:[~2026-07-10 1:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260710014109.536177-1-xmei5@asu.edu \
--to=xmei5@asu.edu \
--cc=AutonomousCodeSecurity@microsoft.com \
--cc=andrew+netdev@lunn.ch \
--cc=ap420073@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=kys@microsoft.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=tgopinath@linux.microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox