The seg6, ioam6 and rpl lwtunnels all grow the headroom with skb_cow_head(), push their new headers into it, and then rebuild the mac header below them with skb_mac_header_rebuild(). The headroom left after the push has to be at least skb->mac_len for that rebuild, but the requests ask for the pushed length plus dst_dev_overhead(), which leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Ask for whichever of the two is larger. These requests carried skb->mac_len until the egress overhead took its place rather than joining it. Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue") Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue") Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue") Assisted-by: LLM Signed-off-by: Yuya Kusakabe Reviewed-by: Justin Iurman --- Changes in v2: - Use max_t(unsigned int, ...) rather than max() [Justin] - Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin] - Reproduce and verify the fix on those two as well: unpatched, rpl underflows in 12 of 16 probed configurations and ioam6 in 3 of 13, both reaching about 64 KB past a 320-byte head; patched, neither underflows in 18 - Rewrap the requests so they no longer exceed 80 columns - Retitle for net: ipv6, now that the change spans three files - Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-02ccec50f096@gmail.com --- net/ipv6/ioam6_iptunnel.c | 8 ++++++-- net/ipv6/rpl_iptunnel.c | 4 +++- net/ipv6/seg6_iptunnel.c | 12 +++++++++--- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c index cfb2c41634a0..4fc745f78eaf 100644 --- a/net/ipv6/ioam6_iptunnel.c +++ b/net/ipv6/ioam6_iptunnel.c @@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_buff *skb, hdrlen = (tuninfo->eh.hdrlen + 1) << 3; - err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; @@ -303,7 +305,9 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb, hdrlen = (tuninfo->eh.hdrlen + 1) << 3; len = sizeof(*hdr) + hdrlen; - err = skb_cow_head(skb, len + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c index 4e10adcd70e8..69d5c7b61e36 100644 --- a/net/ipv6/rpl_iptunnel.c +++ b/net/ipv6/rpl_iptunnel.c @@ -154,7 +154,9 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt, hdrlen = ((csrh->hdrlen + 1) << 3); - err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) { kfree(buf); return err; diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 61c6a27bf202..ed0e8f3ef1f1 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -153,7 +153,9 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, hdrlen = (osrh->hdrlen + 1) << 3; tot_len = hdrlen + sizeof(*hdr); - err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, tot_len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; @@ -255,7 +257,9 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb, tot_len = red_hdrlen + sizeof(struct ipv6hdr); - err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, tot_len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; @@ -351,7 +355,9 @@ static int __seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, hdrlen = (osrh->hdrlen + 1) << 3; - err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err = skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; --- base-commit: 9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed change-id: 20260917-seg6-maclen-headroom-53a339c17dac Best regards, -- Yuya Kusakabe