Re: [PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/21/26 8:42 AM, Tariq Toukan wrote:
> From: Gal Pressman <gal@nvidia.com>
> 
> mlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel
> mode SAs up to date: on every neighbour change it looks for SAs whose
> endpoint matches the neighbour's address. The compare width, 4 bytes for
> IPv4 or 16 for IPv6, is chosen from the SA's address family, with no
> check that the neighbour is of the same family.
> 
> An ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA
> offloaded, any IPv4 neighbour update in the system is compared as if it
> were a 16-byte IPv6 address, reading past the end of the object:
> 
>    BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
>    Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0
>    Call Trace:
>     <IRQ>
>     mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
>     notifier_call_chain+0x97/0x2b0
>     atomic_notifier_call_chain+0x5d/0x130
>     neigh_timer_handler+0x35c/0x1140
>     call_timer_fn+0x164/0x490
>     __run_timers+0x5b9/0x960
>     run_timer_softirq+0xf0/0x1d0
>     handle_softirqs+0x189/0x8a0
>     __irq_exit_rcu+0x10d/0x250
>     ...
> 
>    Allocated by task 1015:
>     __kmalloc_noprof+0x2e6/0x8b0
>     ___neigh_create+0xcc9/0x24c0
>     ip_finish_output2+0xfc7/0x1e80
>     ip_output+0x172/0x3b0
>     ip_send_skb+0xa5/0x1b0
>     udp_send_skb+0x852/0x10f0
>     udp_sendmsg+0x1333/0x2150
>     ...
> 
> The opposite mix (IPv4 SA with IPv6 neighbour) stays in bounds, but only
> the first 32 bits of the IPv6 address are compared, so an unrelated
> neighbour can match.
> 
> Skip neighbours whose address family doesn't match the SA.
> 
> Fixes: 4c24272b4e2b ("net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode")
> Signed-off-by: Gal Pressman <gal@nvidia.com>
> Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
> Reviewed-by: Yael Chemla <ychemla@nvidia.com>
> Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>