* [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
@ 2026-05-05 13:00 Eric Dumazet
2026-05-05 20:37 ` David Ahern
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2026-05-05 13:00 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, David Ahern, netdev, eric.dumazet,
Eric Dumazet, Damiano Melotti
ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.
Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.
Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/ipv6/ip6_output.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7e92909ab5be3f86b10bf9527e97f3bfe794e9e9..aee91ba04130527ceb19881dc1e7232a5d2c8580 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -468,6 +468,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
default:
break;
}
+ hdr = ipv6_hdr(skb);
}
/*
@@ -582,6 +583,8 @@ int ip6_forward(struct sk_buff *skb)
if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {
int proxied = ip6_forward_proxy_check(skb);
+
+ hdr = ipv6_hdr(skb);
if (proxied > 0) {
/* It's tempting to decrease the hop limit
* here by 1, as we do at the end of the
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check()
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
@ 2026-05-05 20:37 ` David Ahern
0 siblings, 0 replies; 2+ messages in thread
From: David Ahern @ 2026-05-05 20:37 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, netdev, eric.dumazet, Damiano Melotti
On 5/5/26 7:00 AM, Eric Dumazet wrote:
> ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
> skb->head.
>
> Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
> the freed memory.
>
> Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
> Reported-by: Damiano Melotti <melotti@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> net/ipv6/ip6_output.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-05 20:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-05 13:00 [PATCH net] ipv6: fix potential UAF caused by ip6_forward_proxy_check() Eric Dumazet
2026-05-05 20:37 ` David Ahern
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox