Re: [Devel] [PATCH vz10 1/7] ms/vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

[Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>]

On 2026-09-01 01:48 +0300, Eva Kurchatova wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> skb_tunnel_check_pmtu() can change skb->head.
> 
> Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.
> 
> Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
> and drivers/net/geneve.c.
> 
> Found by Sashiko.
> 
> Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
> Link: https://patch.msgid.link/20260525203642.2389723-1-edumazet@google.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> (cherry picked from commit 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf)
> 

It doesn't apply. Please rebase

> https://virtuozzo.atlassian.net/browse/VSTOR-139651
> Feature: fix ms/net
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> ---
>  drivers/net/vxlan/vxlan_core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
> index 7c9d2450209a..700bee7e7733 100644
> --- a/drivers/net/vxlan/vxlan_core.c
> +++ b/drivers/net/vxlan/vxlan_core.c
> @@ -2554,7 +2554,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
>  			goto out_unlock;
>  		}
>  
> -		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
> +		tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb);
>  		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
>  		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
>  				      vni, md, flags, udp_sum);
> @@ -2623,7 +2623,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
>  			goto out_unlock;
>  		}
>  
> -		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
> +		tos = ip_tunnel_ecn_encap(tos, ip_hdr(skb), skb);
>  		ttl = ttl ? : ip6_dst_hoplimit(ndst);
>  		skb_scrub_packet(skb, xnet);
>  		err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
> -- 
> 2.55.0
> 
> _______________________________________________
> Devel mailing list
> Devel@openvz.org
> https://lists.openvz.org/mailman/listinfo/devel
> 


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel