[PATCH net v2] ipv6: seg6: clear IPv4 control block in End.DT4

[PATCH net v2] ipv6: seg6: clear IPv4 control block in End.DT4

[David Lee]

From: Kyle Zeng <kylebot@openai.com>

The End.DT4 input path decapsulates an IPv4 packet and sends it
directly to ip_route_input() and dst_input(). It therefore bypasses
ip_rcv_core(), which normally clears IPCB. The skb still contains
IP6CB data from the outer packet, and IPv6 extension-header offsets
overlap the IPv4 option fields. This can make __ip_options_echo()
copy beyond the allocation for saved options.

Clear IPCB after validating the inner IPv4 header and preserve the
ingress interface as ip_rcv_core() does. This prevents outer IPv6
metadata from being interpreted as inner IPv4 options.

Fixes: 664d6f86868b ("seg6: add support for the SRv6 End.DT4 behavior")
Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
Changes in v2:
- Restore Kyle Zeng as the patch author and correct the sign-off chain.

v1: https://lore.kernel.org/all/20260731140832.567669-1-david.lee@trailofbits.com/

Trail of Bits has a reproducer for this bug that triggers a KASAN
slab-out-of-bounds write in __ip_options_echo() and can share if needed.

 net/ipv6/seg6_local.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 2b41e4c0d..d03b377f5 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -1186,6 +1186,9 @@ static int input_action_end_dt4(struct sk_buff *skb,
 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
 		goto drop;
 
+	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+	IPCB(skb)->iif = skb->skb_iif;
+
 	skb = end_dt_vrf_core(skb, slwt, AF_INET);
 	if (!skb)
 		/* packet has been processed and consumed by the VRF */
-- 
2.53.0

Re: [PATCH net v2] ipv6: seg6: clear IPv4 control block in End.DT4

[Nicolas Dichtel]

Le 04/08/2026 à 11:46, David Lee a écrit :
> From: Kyle Zeng <kylebot@openai.com>
> 
> The End.DT4 input path decapsulates an IPv4 packet and sends it
> directly to ip_route_input() and dst_input(). It therefore bypasses
> ip_rcv_core(), which normally clears IPCB. The skb still contains
> IP6CB data from the outer packet, and IPv6 extension-header offsets
> overlap the IPv4 option fields. This can make __ip_options_echo()
> copy beyond the allocation for saved options.
> 
> Clear IPCB after validating the inner IPv4 header and preserve the
> ingress interface as ip_rcv_core() does. This prevents outer IPv6
> metadata from being interpreted as inner IPv4 options.
> 
> Fixes: 664d6f86868b ("seg6: add support for the SRv6 End.DT4 behavior")
> Assisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Co-developed-by: David Lee <david.lee@trailofbits.com>
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> ---
> Changes in v2:
> - Restore Kyle Zeng as the patch author and correct the sign-off chain.

You didn't answer my previous question:

> End.DX4 also calls ip_route_input(). I guess the same problem exists. Am I
> wrong?

Re: [PATCH net v2] ipv6: seg6: clear IPv4 control block in End.DT4

[Nicolas Dichtel]

Le 05/08/2026 à 12:17, David Lee a écrit :
> Hi Nicoals,
Hi,

please avoid top-posting ;-)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst#n336
> 
> You were right. I tested End.DX4 separately on the 62cc90241548 (v7.2-rc5)
> kernel and it produced:
> 
> BUG: KASAN: slab-out-of-bounds in __ip_options_echo()
> Write of size 255
> 
> The stack contains both input_action_end_dx4_finish() and
> input_action_end_dx4(). A matched bounded control traversed End.DX4,
> reached SYN_RECV, and produced no kernel diagnostic.
> 
>  Therefore, End.DX4 has the same stale IP6CB-to-IPCB issue. The current
>  patch only clears IPCB in End.DT4 and is incomplete.
> 
> Do you prefer v3 to be sent out to cover this case too?
Yes, it would be nice to fix both in the same time.

Regards,
Nicolas