Eric Dumazet 7aaa8f5e45 ipv6: fix potential UAF caused by ip6_forward_proxy_check() ... ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate skb->head. Reload ipv6_hdr() after the pskb_may_pull() call to avoid using the freed memory. Fixes: e21e0b5f19 ("[IPV6] NDISC: Handle NDP messages to proxied addresses.") Reported-by: Damiano Melotti <melotti@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-05-06 17:29:23 -07:00
..
ila	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
netfilter	netfilter: nf_socket: skip socket lookup for non-first fragments	2026-04-30 17:59:01 +02:00
addrconf_core.c	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
addrconf.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
addrlabel.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
af_inet6.c	tcp: update window_clamp when SO_RCVBUF is set	2026-04-13 15:32:35 +02:00
ah6.c	xfrm: ah: account for ESN high bits in async callbacks	2026-04-20 09:28:34 +02:00
anycast.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
calipso.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
datagram.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
esp6_offload.c	xfrm: Fix inner mode lookup in tunnel mode GSO segmentation	2025-12-04 09:54:53 +01:00
esp6.c	xfrm: esp: avoid in-place decrypt on shared skb frags	2026-05-05 06:38:30 +02:00
exthdrs_core.c	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
exthdrs_offload.c
exthdrs.c	ipv6: rpl: reserve mac_len headroom when recompressed SRH grows	2026-04-27 17:47:26 -07:00
fib6_notifier.c	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
fib6_rules.c	ipv6: export fib6_lookup for nft_fib_ipv6	2026-03-04 11:45:44 +01:00
fou6.c	fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err().	2026-03-17 16:10:59 -07:00
icmp.c	ipv6: fix possible UAF in icmpv6_rcv()	2026-04-18 12:09:52 -07:00
inet6_connection_sock.c	tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c	2026-02-24 17:47:27 -08:00
inet6_hashtables.c	tcp: use __jhash_final() in inet6_ehashfn()	2026-03-29 11:45:48 -07:00
ioam6_iptunnel.c	ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()	2026-02-13 12:24:05 -08:00
ioam6.c	net: ioam6: fix OOB and missing lock	2026-04-08 19:08:56 -07:00
ip6_checksum.c	udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV.	2026-03-13 18:57:45 -07:00
ip6_fib.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-02 11:03:13 -07:00
ip6_flowlabel.c	net: ipv6: flowlabel: defer exclusive option free until RCU teardown	2026-03-31 15:44:29 -07:00
ip6_gre.c	ip6_gre: Use cached t->net in ip6erspan_changelink().	2026-05-02 10:36:21 -07:00
ip6_icmp.c	ipv6: remove dynamic ICMPv6 sender registration infrastructure	2026-03-29 11:21:23 -07:00
ip6_input.c	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
ip6_offload.c	ipv6: replace IS_BUILTIN(CONFIG_IPV6) with IS_ENABLED(CONFIG_IPV6)	2026-03-29 11:21:23 -07:00
ip6_offload.h
ip6_output.c	ipv6: fix potential UAF caused by ip6_forward_proxy_check()	2026-05-06 17:29:23 -07:00
ip6_tunnel.c	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
ip6_udp_tunnel.c	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
ip6_vti.c	ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers	2025-07-02 14:32:30 -07:00
ip6mr.c	ipmr/ip6mr: Convert net->ipv[46].ipmr_seq to atomic_t.	2026-03-02 18:49:41 -08:00
ipcomp6.c	xfrm: delete x->tunnel as we delete x	2025-07-08 13:28:27 +02:00
ipv6_sockglue.c	ipv6: Remove UDP-Lite support for IPV6_ADDRFORM.	2026-03-13 18:57:44 -07:00
Kconfig	ipv6: default IPV6_SIT to m	2026-05-05 17:31:51 -07:00
Makefile	ipv6: Retire UDP-Lite.	2026-03-13 18:57:44 -07:00
mcast_snoop.c
mcast.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mip6.c
ndisc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-02 11:03:13 -07:00
netfilter.c	netfilter: remove nf_ipv6_ops and use direct function calls	2026-03-29 11:21:24 -07:00
output_core.c	ipv6: move ip6_dst_hoplimit() to net/ipv6/ip6_output.c	2026-04-01 18:50:35 -07:00
ping.c	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
proc.c	udp: Remove UDP-Lite SNMP stats.	2026-03-13 18:57:44 -07:00
protocol.c
raw.c	net: change sock_queue_rcv_skb_reason() to return a drop_reason	2026-04-12 14:30:25 -07:00
reassembly.c	ipv6: discard fragment queue earlier if there is malformed datagram	2026-02-27 19:08:54 -08:00
route.c	ipv6: Fix null-ptr-deref in fib6_mtu().	2026-05-05 17:32:57 -07:00
rpl_iptunnel.c	net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels	2026-04-28 11:16:14 +02:00
rpl.c
seg6_hmac.c	ipv6: add NULL checks for idev in SRv6 paths	2026-03-18 17:23:43 -07:00
seg6_iptunnel.c	net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels	2026-04-28 11:16:14 +02:00
seg6_local.c	ipv6: adopt dst_dev() helper	2025-07-02 14:32:30 -07:00
seg6.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
sit.c	ipv6: sit: remove redundant ret = 0 assignment	2026-04-09 20:37:40 -07:00
syncookies.c	tcp: secure_seq: add back ports to TS offset	2026-03-04 17:44:35 -08:00
sysctl_net_ipv6.c
tcp_ao.c
tcp_ipv6.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
tcpv6_offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-01-29 17:28:54 -08:00
tunnel6.c
udp_offload.c	udp: Don't pass udptable to IPv6 socket lookup functions.	2026-03-13 18:57:46 -07:00
udp.c	udp: Force compute_score to always inline	2026-04-13 15:44:42 -07:00
xfrm6_input.c	xfrm: hold dev ref until after transport_finish NF_HOOK	2026-04-07 10:12:40 +02:00
xfrm6_output.c	ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers	2025-07-02 14:32:30 -07:00
xfrm6_policy.c	xfrm6: fix uninitialized saddr in xfrm6_get_saddr()	2026-02-02 08:03:47 +01:00
xfrm6_protocol.c	ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()	2026-04-17 10:40:29 +02:00
xfrm6_state.c
xfrm6_tunnel.c	xfrm: flush all states in xfrm_state_fini	2025-08-06 09:23:38 +02:00