github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.2
linux/net/ipv6
History
Zhiling Zou f803c08639 ip6_tunnel: clear skb2->cb[] in ip6ip6_err() 
ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the
quoted inner IPv6 packet, and then passes the clone to icmpv6_send().
The clone still carries the outer packet's inet6_skb_parm in skb->cb.

If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao
remains non-zero after skb_pull(). icmpv6_send() later calls
mip6_addr_swap(), which uses that stale dsthao offset against the quoted
inner packet. A malformed inner destination-options header can then make
the HAO lookup and address swap run past the end of the quoted packet
and corrupt skb_shared_info.

Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the
reply path does not reuse metadata left by the outer IPv6 stack.

Fixes: e490d1d85c ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.1785736562.git.zhilinz@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05 17:30:38 -07:00
..
ila ila: reload IPv6 header after pskb_may_pull in checksum adjust 2026-07-22 14:00:41 -07:00
netfilter netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
addrconf_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
addrconf.c ipv6: fix missing notification for ignore_routes_with_linkdown 2026-06-23 19:12:48 -07:00
addrlabel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
af_inet6.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
ah6.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
anycast.c ipv6: anycast: insert aca into global hash under idev->lock 2026-06-02 19:30:39 -07:00
calipso.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c ipv6: validate extension header length before copying to cmsg 2026-05-26 18:53:10 -07:00
esp6_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp6.c esp: fix page frag reference leak on skb_to_sgvec failure 2026-06-09 15:58:17 +02:00
exthdrs_core.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
exthdrs_offload.c net: gso: add HBH extension header offload support 2024-01-05 08:11:49 -08:00
exthdrs.c ipv6: exthdrs: recompute network header pointer once 2026-06-03 19:14:56 -07:00
fib6_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib6_rules.c net: ipv6: clear suppressed fib6 rule result 2026-07-27 15:20:01 -07:00
fou6.c fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err(). 2026-03-17 16:10:59 -07:00
icmp.c ipv6: fix possible UAF in icmpv6_rcv() 2026-04-18 12:09:52 -07:00
inet6_connection_sock.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
inet6_hashtables.c tcp: use __jhash_final() in inet6_ehashfn() 2026-03-29 11:45:48 -07:00
ioam6_iptunnel.c ipv6: ioam: fix type confusion of dst_entry 2026-06-21 15:26:40 -07:00
ioam6.c net: ioam6: no longer acquire qdisc spinlock while calling qdisc_qstats_qlen_backlog() 2026-05-14 17:05:20 -07:00
ip6_checksum.c udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV. 2026-03-13 18:57:45 -07:00
ip6_fib.c ipv6: release fib6_null_entry on subtree failure 2026-07-29 16:49:39 -07:00
ip6_flowlabel.c ipv6: use READ_ONCE() in ipv6_flowlabel_get() 2026-06-04 18:31:18 -07:00
ip6_gre.c net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM 2026-07-23 13:01:57 +02:00
ip6_icmp.c ipv6: remove dynamic ICMPv6 sender registration infrastructure 2026-03-29 11:21:23 -07:00
ip6_input.c ipv6: Implement limits on extension header parsing 2026-04-30 17:21:45 -07:00
ip6_offload.c net: pppoe: implement GRO/GSO support 2026-05-19 09:47:53 +02:00
ip6_offload.h
ip6_output.c net: do not send ICMP/NDISC Redirects when peer allocation fails 2026-07-27 13:54:16 -07:00
ip6_tunnel.c ip6_tunnel: clear skb2->cb[] in ip6ip6_err() 2026-08-05 17:30:38 -07:00
ip6_udp_tunnel.c udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup(). 2026-05-05 17:47:04 -07:00
ip6_vti.c net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ip6mr.c ipmr: Convert mr_table.cache_resolve_queue_len to u32. 2026-06-11 15:17:30 -07:00
ipcomp6.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipv6_sockglue.c ipv6: Remove UDP-Lite support for IPV6_ADDRFORM. 2026-03-13 18:57:44 -07:00
Kconfig ipv6: default IPV6_SIT to m 2026-05-05 17:31:51 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
mcast_snoop.c
mcast.c ipv6: mcast: Fix potential UAF in MLD delayed work 2026-07-08 14:41:01 +02:00
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c net: do not send ICMP/NDISC Redirects when peer allocation fails 2026-07-27 13:54:16 -07:00
netfilter.c netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() 2026-07-10 16:28:47 +02:00
output_core.c ipv6: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:42 -07:00
ping.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw.c net: ipv6: fix dif and sdif mismatch in raw6_icmp_error 2026-07-23 08:31:44 -07:00
reassembly.c ipv6: frags: cleanup __IP6_INC_STATS() confusion 2026-05-27 17:27:26 -07:00
route.c ipv6: fix Route Information option length validation 2026-08-03 14:26:14 -07:00
rpl_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
rpl.c ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv(). 2023-06-19 11:32:58 -07:00
seg6_hmac.c ipv6: add NULL checks for idev in SRv6 paths 2026-03-18 17:23:43 -07:00
seg6_iptunnel.c net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels 2026-04-28 11:16:14 +02:00
seg6_local.c ipv6: adopt dst_dev() helper 2025-07-02 14:32:30 -07:00
seg6.c seg6: validate SRH length before reading fixed fields 2026-06-26 18:49:37 -07:00
sit.c net: sit: require CAP_NET_ADMIN in the device netns for changelink 2026-06-21 15:10:06 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c net/tcp-ao: Return void from functions that can no longer fail 2026-04-30 09:38:56 +02:00
tcp_ipv6.c tcp: initialize standalone TCP-AO response padding 2026-07-21 15:24:36 -07:00
tcpv6_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-01-29 17:28:54 -08:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp_offload.c udp: Don't pass udptable to IPv6 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp.c udp: Force compute_score to always inline 2026-04-13 15:44:42 -07:00
xfrm6_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm6_output.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
xfrm6_policy.c xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() 2026-07-06 08:29:08 +02:00
xfrm6_protocol.c ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() 2026-04-17 10:40:29 +02:00
xfrm6_state.c
xfrm6_tunnel.c xfrm: flush all states in xfrm_state_fini 2025-08-06 09:23:38 +02:00