[PATCH] mpls: reject headroom that overflows skb header offsets

[Kyle Zeng <kylebot@openai.com>]

MPLS output reserves LL_RESERVED_SPACE(out_dev) plus the size of the
new label stack with skb_cow_head() or skb_cow(). The aligned expansion
can leave skb->data more than U16_MAX bytes past skb->head. Resetting
the network header then truncates the offset, so mpls_hdr() addresses
the wrong location. The subsequent neighbour output passes the negative
skb_network_offset() to __skb_pull() as an unsigned length and can write
an Ethernet header outside the skb allocation.

For example, a netkit device with needed_headroom 65488 gives an initial
network offset of 65504. Pushing one MPLS label requests 65508 bytes of
headroom, but with NET_SKB_PAD=64 the COW adds 64 bytes. The new network
offset is 65564 and truncates to 28. This can be reached with an ordinary
non-GSO IPv4 packet in a user-owned network namespace.

Check the actual headroom after COW, including its alignment slack,
before installing the inner header or pushing labels. Apply the same
check to native MPLS forwarding, including its penultimate-hop popping
path. Use the existing transmit-error and skb disposal paths.

Fixes: e3e4712ec096 ("mpls: ip tunnel support")
Fixes: 0189197f4416 ("mpls: Basic routing support")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue and can share via DM

 net/mpls/af_mpls.c       | 4 ++++
 net/mpls/mpls_iptunnel.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index ad4ad6f2001a..4bfdb7c81f04 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -453,6 +453,10 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
 	if (skb_cow(skb, hh_len + new_header_size))
 		goto tx_err;
 
+	/* The aligned expansion must still fit the u16 header offsets. */
+	if (unlikely(skb_headroom(skb) > U16_MAX))
+		goto tx_err;
+
 	skb->dev = out_dev;
 	skb->protocol = htons(ETH_P_MPLS_UC);
 
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index 1a1a0eb5b787..4eccbd911fe1 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -109,6 +109,10 @@ static int mpls_xmit(struct sk_buff *skb)
 	if (skb_cow_head(skb, hh_len + new_header_size))
 		goto drop;
 
+	/* The aligned expansion must still fit the u16 header offsets. */
+	if (unlikely(skb_headroom(skb) > U16_MAX))
+		goto drop;
+
 	skb_set_inner_protocol(skb, skb->protocol);
 	skb_reset_inner_network_header(skb);
 

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0