[PATCH nf v2] ipvs: clear IPv4 options after rebasing tunnel ICMP errors

[PATCH nf v2] ipvs: clear IPv4 options after rebasing tunnel ICMP errors

[David Lee]

From: Kyle Zeng <kylebot@openai.com>

ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.

A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.

Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.

Fixes: f2edb9f7706d ("ipvs: implement passive PMTUD for IPIP packets")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
Changes in v2:
- Add the nf tree prefix to the subject.
- Restore Kyle Zeng as the patch author and correct the sign-off chain.
- Move the research credit below the commit-message separator.

v1: https://lore.kernel.org/netdev/20260731140822.567128-1-david.lee@trailofbits.com/

Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.

Trail of Bits has a reproducer for this bug that triggers a
KASAN stack-out-of-bounds write in __ip_options_echo() and can share
if needed.

 net/netfilter/ipvs/ip_vs_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index bafab9345..fe06c380c 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1951,6 +1951,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
 		if (pskb_pull(skb, offset2) == NULL)
 			goto ignore_tunnel;
 		skb_reset_network_header(skb);
+		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 		/* Ensure the IP header is present in headroom */
 		if (!pskb_may_pull(skb, hlen_orig))
 			goto ignore_tunnel;
-- 
2.53.0

Re: [PATCH nf v2] ipvs: clear IPv4 options after rebasing tunnel ICMP errors

[Julian Anastasov]

	Hello,

On Tue, 4 Aug 2026, David Lee wrote:

> From: Kyle Zeng <kylebot@openai.com>
> 
> ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
> quoted original request before passing it to icmp_send(). However,
> IPCB(skb)->opt still describes the outer IPv4 header.
> 
> A timestamp option in the outer header can therefore leave an offset
> that points into the quoted transport header after the rebase.
> __ip_options_echo() treats a byte at that stale location as the option
> length and copies it into the fixed-size option storage on the
> __icmp_send() stack, causing a stack out-of-bounds write.
> 
> Clear the stale option metadata after resetting the network header.
> Keep the remaining control block fields, including the ingress
> interface used by the ICMP response path.
> 
> Fixes: f2edb9f7706d ("ipvs: implement passive PMTUD for IPIP packets")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Co-developed-by: David Lee <david.lee@trailofbits.com>
> Signed-off-by: David Lee <david.lee@trailofbits.com>

	Looks good to me, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

> ---
> Changes in v2:
> - Add the nf tree prefix to the subject.
> - Restore Kyle Zeng as the patch author and correct the sign-off chain.
> - Move the research credit below the commit-message separator.
> 
> v1: https://lore.kernel.org/netdev/20260731140822.567128-1-david.lee@trailofbits.com/
> 
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
> 
> Trail of Bits has a reproducer for this bug that triggers a
> KASAN stack-out-of-bounds write in __ip_options_echo() and can share
> if needed.
> 
>  net/netfilter/ipvs/ip_vs_core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index bafab9345..fe06c380c 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -1951,6 +1951,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
>  		if (pskb_pull(skb, offset2) == NULL)
>  			goto ignore_tunnel;
>  		skb_reset_network_header(skb);
> +		memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
>  		/* Ensure the IP header is present in headroom */
>  		if (!pskb_may_pull(skb, hlen_orig))
>  			goto ignore_tunnel;
> -- 
> 2.53.0

Regards

--
Julian Anastasov <ja@ssi.bg>