Messages in this thread | | | Date | Tue, 7 Dec 2021 17:50:38 -0700 | Subject | Re: [PATCH] ipv6: fix NULL pointer dereference in ip6_output() | From | David Ahern <> |
| |
On 12/7/21 5:21 PM, Andrea Mayer wrote: > > When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving > interface index into the IPv4 socket control block (v5.16-rc4, > net/ipv4/ip_input.c line 510): > IPCB(skb)->iif = skb->skb_iif; > > If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH header, > the seg6_do_srh_encap(...) performs the required encapsulation. > In this case, the seg6_do_srh_encap function clears the IPv6 socket control > block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163): > memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); > > The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear > IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29). > > Since the IPv6 socket control block and the IPv4 socket control block share the > same memory area (skb->cb), the receiving interface index info is lost > (IP6CB(skb)->iif is set to zero). > > As a side effect, that condition triggers a NULL pointer dereference if patch > 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig netdev") is > applied. > > To fix that, I can send a patch where we set the IP6CB(skb)->iif to the > index of the receiving interface, i.e.: > > int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) > [...] > ip6_flow_hdr(hdr, 0, flowlabel); > hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb)); > > memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); > + IP6CB(skb)->iif = skb->skb_iif; > [...] > > What do you think? >
I like that approach over the need for a fall back in core ipv6 code. Make sure the above analysis is in the commit message. Thanks for the quick response,
| |