__ip_options_compile() updates Record Route and Timestamp options in place. ipv4_send_dest_unreach() can receive skbs whose data is shared with clones (for example TC-mirred copies or TCP transmit clones), and pskb_network_may_pull() does not unshare an already linear IPv4 header. Concurrent link-failure processing of such clones can therefore change an option pointer after it has been checked. For example, a Record Route pointer can advance during fib_compute_spec_dst() (called from spec_dst_fill()), causing the following write to overwrite the next option's length. __ip_options_echo() then trusts that length when building the ICMP reply, which can overflow both the stack reply-option buffer and the cork-option allocation. Uncloning the skb is not an option: ipv4_send_dest_unreach() runs as the dst_link_failure() callback, and callers such as ip_tunnel_xmit() keep pointers into skb->head (inner_iph, and tnl_params for GRE devices with header_ops) across the call. Instead, recompile and echo the options on a private pskb_copy(), leaving the caller's skb untouched. This also stops rewriting the options of a packet the caller may still transmit. If the copy fails, do not send the ICMP error. The issue was found by an AI code review agent. It was not reproduced, and the fix was only build-tested. Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") Reported-by: Kyle Zeng Signed-off-by: Eric Dumazet --- v2: use a private pskb_copy() instead of skb_unclone(), callers of dst_link_failure() cache pointers into skb->head (Sashiko). v1: https://lore.kernel.org/netdev/20261106234313.2537882-1-edumazet@kernel.org/ net/ipv4/route.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 3a90c8d28b940bf615c165d9b30ac634943586e1..9af72cb892034deff2bb3169911c02c025d73cf2 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1256,6 +1256,7 @@ EXPORT_INDIRECT_CALLABLE(ipv4_dst_check); static void ipv4_send_dest_unreach(struct sk_buff *skb) { + struct sk_buff *nskb = NULL; struct inet_skb_parm parm; struct net_device *dev; int res; @@ -1271,6 +1272,16 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb) if (ip_hdr(skb)->ihl > 5) { if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4)) return; + + /* __ip_options_compile() writes into the options, and + * callers of dst_link_failure() may cache pointers into + * skb->head: work on a private copy. + */ + nskb = pskb_copy(skb, GFP_ATOMIC); + if (!nskb) + return; + skb = nskb; + parm.opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr); rcu_read_lock(); @@ -1279,9 +1290,11 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb) rcu_read_unlock(); if (res) - return; + goto out; } __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &parm); +out: + consume_skb(nskb); } static void ipv4_link_failure(struct sk_buff *skb) -- 2.53.0