Re: [PATCH net v2 1/1] seg6: reset IP6CB after IPv6 decapsulation

[Andrea Mayer <andrea.mayer@uniroma2.it>]

On Sat, 22 Aug 2026 16:49:27 +0800
Zhiling.Zou.zhilinz@nebusec.ai wrote:

> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> decap_and_validate() pulls the outer SRv6 headers and makes the inner
> packet the skb network header. The IPv6 control block still contains
> values collected while parsing the outer packet, including nhoff and
> extension-header flags.
> 
> End.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6
> input path. An unprivileged user can reach End.DT6 from a user and net
> namespace by installing a local SID and injecting an outer packet with
> Hop-by-Hop and Destination Options headers followed by an SRH and a
> minimal inner IPv6 packet.
> 
> The outer extension headers leave a large nhoff in IP6CB. After
> decapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the
> inner packet and reads beyond the skb head. KASAN reports:
> 
>   BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu
>   ip6_protocol_deliver_rcu+0x1118/0x1450
>   ip6_input_finish+0x11b/0x240
>   seg6_local_input_core+0xed/0x2e0
>   lwtunnel_input+0x1e9/0x4e0
>   ipv6_rthdr_rcv+0x525f/0x6c50
>   ip6_protocol_deliver_rcu+0xcb7/0x1450
> 
> Before clearing IP6CB for an inner IPv6 packet, save its incoming
> interface index and L3 slave state. Restore both after the clear and set
> nhoff to the inner IPv6 base-header nexthdr field.
> 
> Use IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can
> replace skb_iif with the L3 master while IP6CB keeps the receiving
> interface. Preserve IP6SKB_L3SLAVE for the same reason.
> 
> Fixes: d7a669dd2f8b ("ipv6: sr: add helper functions for seg6local")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
> changes in v2:
> - Preserve the ingress index from IP6CB instead of using skb->skb_iif.
> - Preserve IP6SKB_L3SLAVE across the IPv6 control-block reset.
> - Place the IPv6 reset next to the merged IPv4 reset.
> - Add reachability and the relevant KASAN call chain to the commit log.
> - v1 Link: https://lore.kernel.org/all/6a236dcc43d141a9105e8ee1b84bcccc628d83b0.1786894895.git.zhilinz@nebusec.ai/  
> 

In the mail I received, the From header is Zhiling.Zou.zhilinz@nebusec.ai,
which is not the address you sign with.
From what I see, patchwork records it without the angle brackets too.

The patch looks good to me.

Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>