From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f169.google.com (mail-qt1-f169.google.com [209.85.160.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DBBE30DECC for ; Wed, 17 Jun 2026 12:35:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781699701; cv=none; b=iz6NXf3cjXIUDH4rDqNbo323alWiC1aaUSfW0F41i90z7O04/ZXpHMuWmtTV9Zu3HGNxzb2Xu5xacvJ3zvROtkHRiDTPhI80udCUcGe7rg4Ut8nJPzD7Ow0mPcda57FgdQnqKpuCKyzfAmAwB1fQIpkioE+gSjWGwXo10A5aygw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781699701; c=relaxed/simple; bh=YSCPBbWl4roN1mtl+il3bx/ZLX4V0jvj5e6gRBXVirM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fKziMxcAoRV7e8VkqBBf1l3oUSxR94RWmnswapXNbGW5VQ8qWDhnuc5pI+DGNhqJKOF+yjTk9uxzeGd22dk1QMFQAuyo5/DLx+VejOM02gwaAVB3xCJrtjW7FUUa0lLj0rMokfBwgxGwH3AgpVPFvrTF1AqPJAwrPObNGBzUkkQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=l5EIKSg+; arc=none smtp.client-ip=209.85.160.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="l5EIKSg+" Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-5199da044e6so17641471cf.3 for ; Wed, 17 Jun 2026 05:35:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781699699; x=1782304499; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=uHZZLSqHFkc/ECYF16dyHEttzRgMJKqUzG20tg4x0F0=; b=l5EIKSg+kQGnciXADfLlWM2lCFPXARN8VbFlfCo5yuqidceLr5ECHEN685gvKcGl6e Xup2yooANvOYXK3cCLBcdP4Q4OHYS/PQIn1LpsPnQvbFz95sa34KHtgNHOO9v66cZLCA 8a5I1hjagShKdVZHJnqxvhNXKIZYEJ0VcEZlpG9sylUVktUzQuqBQu6KdXjDcvoMbdPm UKYr6AyUB/Xy/DIOv80v/wWGWSQrOlu1s1dbzYrHW41TJylQNusuKLi2UVu08mMfH6/r AdvToOdht6X8a9ofO5GQFrqVOXP6iieK48Z7DgPmU2j9vZ9OJDzKw7DiQ43StxXrn5C+ xbwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781699699; x=1782304499; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=uHZZLSqHFkc/ECYF16dyHEttzRgMJKqUzG20tg4x0F0=; b=LXh6Vmd64WpNlxNAhf30rdGXtQQd4b5pQ7BBsurK7/UnKW9B4rXz34XChwPCx4mbfj f6QQ64XvG+qHbNzJzRhqJK6oZlqKvYdwF0DBTXHlb3Y3bViRCPREAbAV6pxn6YL4Jmzo hqrVsivNyJU4nCpvEoXoifVKqW5YXrMV1+5cwy5k+k19rClLsnM/sYfo/K8BK5qviEd3 QBUSJgoSoGtqOMP9zsV9+B1L8399jVqoKKcrb7y45aWYs1dsAnWLCvc5yTFp6SqvvsQL 7aWqs7aaglKpapK3HOV9PW/rBALrm2rUZSgaIaOQiGMSgWlPkhKUreAawKscKnvNjdZg B1yg== X-Forwarded-Encrypted: i=1; AFNElJ/GCPxmJITXRq3KAUtSEXK5PnYAVSxWlynm2Fso6s3TBZ7fiAHXKo2Lh3Ad9thwogTEItK0OFfOOc3fq34=@vger.kernel.org X-Gm-Message-State: AOJu0YylnaDaqJwQYveCRi9EIgT+B4ZltUxCkK2IluPmuUfN5BWf/qiP Qd4JMuXj9CZpCaJTcaJ6J9VcByU+hDpTP/89r+do6ZAIF63Ft5oo8OgZ X-Gm-Gg: Acq92OGUROdKHFIGOk6mwH1VE+4H/pmHpMJco+fuunKr3ehrdWK4ZBjJNMNmu7B7nqa 5T0SowS5wyf2gCQQeoUEcOYqEv8vPSAT3ILYjkTuUAyTQoQrk2HesuKuF76Ul4kGQhoIgRW42BG ZfTFbqsBP2J/zm1oNnL08n2M4f8pRop5s2mpA80z/30t3HWACW56kGa4E3POzuBamMPyw7w4dw2 H+STIzYr+JzU95Gur7V4DonD5y7hAFufxIX9fefrblby+l5ZUtVRlw/g8SrvujYUBwJaOLJF382 1pQRi+w1NAjAkBt76908XvDb9J/hzSaEGAJIeRhiB16ZW9SlXpZYCtDgwum2uilcCePW0RMdA8n FpPVwFvlfCaYgHnJmSDS0Sxi9ww2blPHTKt1OT8zIdVZeOBU7RMAJjrkaBLqqzCt85zOYKLvc2U jE4DnsjFLsueamlloOzo7b+lPUT4RfUKM7CZlV2Iu+QJPSUh3EiuGmtRzsaZaxDrwfjBnAsM7jq iH++CAfu9tD4wE+8n5MqA4MNHzf7tgJ X-Received: by 2002:a05:622a:a54c:b0:517:a023:39b5 with SMTP id d75a77b69052e-519a8fa6ad8mr45491571cf.33.1781699699277; Wed, 17 Jun 2026 05:34:59 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-517fb642740sm167164481cf.7.2026.06.17.05.34.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Jun 2026 05:34:58 -0700 (PDT) From: Michael Bommarito To: Taehee Yoo , "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet Cc: Andrew Lunn , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v2] amt: don't read the IP source address from a reallocated skb header Date: Wed, 17 Jun 2026 08:34:43 -0400 Message-ID: <20260617123443.3586930-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit amt_update_handler() caches iph = ip_hdr(skb) and then calls pskb_may_pull(). pskb_may_pull() can reallocate the skb head: the new head is allocated and the old one is freed. The cached iph is not refreshed, so the following tunnel lookup reads iph->saddr from the freed head. On an AMT relay this lookup runs for every incoming membership update, before the update's nonce and response MAC are validated. The sibling handlers amt_multicast_data_handler() and amt_membership_query_handler() re-read ip_hdr() after the pull and are not affected; only amt_update_handler() keeps the pre-pull pointer. Snapshot the source address before the pulls and match against the snapshot. The stale read was confirmed by instrumentation rather than a sanitizer: after the head is reallocated the comparison reads from the freed old head. KASAN does not flag it because the skb head is released through the page-fragment free path, which is not poisoned on free. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Acked-by: Taehee Yoo Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- v2: per Taehee Yoo's review (https://lore.kernel.org/all/CAMArcTWCg4x1bxrzr+XHc_FqbzJELCMu+tE=x8Jhewgr-_A3Rw@mail.gmail.com/): - retag the subject as [PATCH net] (this is a bug fix); - drop Cc: stable -- the Fixes tag is enough for the stable backport process to pick it up; - carry Taehee Yoo's Acked-by. No code change from v1. v1: https://lore.kernel.org/all/20260614155539.3106537-1-michael.bommarito@gmail.com/ Confirmed on x86_64 by instrumenting the comparison: with the update packet built so the first pskb_may_pull() reallocates the head (it pulls bytes out of a page fragment with no tailroom), the read runs against the freed old head -- the head pointer moves and the old page's refcount is 0. Neither generic KASAN nor arm64 HW-tag KASAN reports it: page- fragment frees are not synchronously poisoned, and under MTE the freed page keeps a tag matching the stale pointer, so this class of stale- header read escapes the usual fuzzing oracles. On a live relay the freed head is also exposed to reuse by later skb allocations. amtdbg: cmp reads iph=...e000 (skb->head=...384380) stale_head=1 ref=0 A KUnit covering the re-read can follow separately. drivers/net/amt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/amt.c b/drivers/net/amt.c index f2f3139..af6e28d 100644 --- a/drivers/net/amt.c +++ b/drivers/net/amt.c @@ -2455,8 +2455,10 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) struct ethhdr *eth; struct iphdr *iph; int len, hdr_size; + __be32 saddr; iph = ip_hdr(skb); + saddr = iph->saddr; hdr_size = sizeof(*amtmu) + sizeof(struct udphdr); if (!pskb_may_pull(skb, hdr_size)) @@ -2472,7 +2474,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) skb_reset_network_header(skb); list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) { - if (tunnel->ip4 == iph->saddr) { + if (tunnel->ip4 == saddr) { if ((amtmu->nonce == tunnel->nonce && amtmu->response_mac == tunnel->mac)) { mod_delayed_work(amt_wq, &tunnel->gc_wq, base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 -- 2.53.0