Re: [PATCH net 1/1] ipv6: xfrm: use full sockets in local error paths
Steffen Klassert <[email protected]>
| Newsgroups | org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Aug 03, 2026 at 09:28:58PM +0800, Zhiling Zou wrote:
> xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it
> always pointed at a full IPv6 socket.
>
> That is not guaranteed. TCP SYN-ACK skbs can be owned by a
> TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the
> full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower
> MTU, the local PMTU/error handling path can reach these callbacks with that
> mini-socket still attached to the skb.
>
> The callbacks then miscast the request socket as a full inet/IPv6 socket and
> can read beyond the request_sock allocation when they access inet_sock or
> ipv6_pinfo state.
>
> Resolve the owner with skb_to_full_sk() in both callbacks and bail out when
> no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error
> logic, which already reasons about full sockets with skb_to_full_sk().
>
> Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Signed-off-by: Zhiling Zou <[email protected]>
Applied, thanks a lot!