[PATCH net 1/1] seg6: reset IP6CB after IPv6 decapsulation

decap_and_validate() pulls the outer SRv6 headers and makes the
inner packet the skb network header. The IPv6 control block still
contains values collected while parsing the outer packet, including
nhoff and extension-header flags.

End.DX6 and End.DT6 then route the inner IPv6 packet directly to
the IPv6 input path. If an outer extension header left a large
nhoff, ip6_protocol_deliver_rcu() reads
skb_network_header(skb)[nhoff] from the inner packet, which may be
beyond the skb head.

Clear IP6CB after IPv6 decapsulation, restore the incoming interface,
and initialize nhoff to the inner IPv6 base-header nexthdr field before
delivering the packet.

Fixes: d7a669dd2f8b ("ipv6: sr: add helper functions for seg6local")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Signed-off-by: Zhiling Zou <[email protected]>
---
 net/ipv6/seg6_local.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 2b41e4c0dddd1..4df76fa85d6b4 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -253,6 +253,11 @@ static bool decap_and_validate(struct sk_buff *skb, int proto)
 
 	skb_reset_network_header(skb);
 	skb_reset_transport_header(skb);
+	if (proto == IPPROTO_IPV6) {
+		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+		IP6CB(skb)->iif = skb->skb_iif;
+		IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+	}
 	if (iptunnel_pull_offloads(skb))
 		return false;
 
-- 
2.43.0