Re: [PATCH net] ip6_tunnel: validate ipv4 header in ip4ip6_err()

[Eric Dumazet <edumazet@google.com>]

On Wed, Mar 25, 2026 at 10:14 AM Eric Dumazet <edumazet@google.com> wrote:
>
> Oskar Kjos reported the following problem.
>
> ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
> by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
> IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
> as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
> at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
> value. __ip_options_echo() then reads optlen from attacker-controlled
> packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
> a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
>
> To fix this we could simply clear skb2->cb[].
>
> In this patch I chose to validate the inner IPv4 header and
> recompute options if any were included.
>
> Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
> Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv6/ip6_tunnel.c | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
> index 4c29aa94e86eb9439458e4b23426bfda8b3b8922..1901348617f0a4f48358c1c8135068f4b861059f 100644
> --- a/net/ipv6/ip6_tunnel.c
> +++ b/net/ipv6/ip6_tunnel.c
> @@ -561,6 +561,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>            u8 type, u8 code, int offset, __be32 info)
>  {
>         __u32 rel_info = ntohl(info);
> +       struct inet_skb_parm parm;
>         const struct iphdr *eiph;
>         struct sk_buff *skb2;
>         int err, rel_msg = 0;
> @@ -606,6 +607,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>         skb_pull(skb2, offset);
>         skb_reset_network_header(skb2);
>         eiph = ip_hdr(skb2);
> +       if (eiph->version != 4 || eiph->ihl < 5)
> +               goto out;
>
>         /* Try to guess incoming interface */
>         rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
> @@ -617,6 +620,18 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>         skb2->dev = rt->dst.dev;
>         ip_rt_put(rt);
>
> +       memset(&parm, 0, sizeof(parm));
> +       if (eiph->ihl > 5) {
> +               if (!pskb_network_may_pull(skb2, eiph->ihl * 4))
> +                       goto out;
> +               eiph = ip_hdr(skb2);
> +               parm.opt.optlen = eiph->ihl * 4 - sizeof(struct iphdr);
> +
> +               err = __ip_options_compile(dev_net(skb->dev), &parm.opt, skb2, NULL);
> +
> +               if (err)
> +                       goto out;
> +       }
>         /* route "incoming" packet */
>         if (rt->rt_flags & RTCF_LOCAL) {
>                 rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
> @@ -644,7 +659,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
>                 skb_dst_update_pmtu_no_confirm(skb2, rel_info);
>         }
>
> -       icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
> +       __icmp_send(skb2, rel_type, rel_code, htonl(rel_info), &parm);
>
>  out:
>         kfree_skb(skb2);
> --
> 2.53.0.1018.g2bb0e51243-goog
>

I will send a V2, because __ip_options_compile() can overwrite the options.

We might need to make sure skb2->head and skb->head are different.