Commit 7aaa8f5e authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

ipv6: fix potential UAF caused by ip6_forward_proxy_check() 



ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.

Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.

Fixes: e21e0b5f ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: default avatarDamiano Melotti <melotti@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 0e1368a2

net/ipv6/ip6_output.c

+3 −0
Original line number Diff line number Diff line
@@ -468,6 +468,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb) 
		default:

			break;

		}

		hdr = ipv6_hdr(skb);

	}



	/*
@@ -582,6 +583,8 @@ int ip6_forward(struct sk_buff *skb) 
	if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&

	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {

		int proxied = ip6_forward_proxy_check(skb);



		hdr = ipv6_hdr(skb);

		if (proxied > 0) {

			/* It's tempting to decrease the hop limit

			 * here by 1, as we do at the end of the