[PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom

[Yuya Kusakabe]

The seg6, ioam6 and rpl lwtunnels all grow the headroom with
skb_cow_head(), push their new headers into it, and then rebuild the mac
header below them with skb_mac_header_rebuild().  The headroom left
after the push has to be at least skb->mac_len for that rebuild, but the
requests ask for the pushed length plus dst_dev_overhead(), which leaves
LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet.

Where the mac header is longer than that, as it is on ingress through a
VLAN device with reorder_hdr off, the rebuild runs out of room:
skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,
stores it unchecked in the u16 skb->mac_header, and the memmove that
follows writes skb->mac_len bytes about 64 KB past skb->head.
Forwarding plain ping6 traffic through such a device reproduces it on
all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;
skb->mac_header comes back as 65534 on a 704-byte head.

Ask for whichever of the two is larger.  These requests carried
skb->mac_len until the egress overhead took its place rather than
joining it.

Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue")
Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue")
Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue")
Assisted-by: LLM
Signed-off-by: Yuya Kusakabe <yuya.kusakabe@xxxxxxxxx>
Reviewed-by: Justin Iurman <justin.iurman@xxxxxxxxx>
---
Changes in v2:
- Use max_t(unsigned int, ...) rather than max() [Justin]
- Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin]
- Reproduce and verify the fix on those two as well: unpatched, rpl
  underflows in 12 of 16 probed configurations and ioam6 in 3 of 13,
  both reaching about 64 KB past a 320-byte head; patched, neither
  underflows in 18
- Rewrap the requests so they no longer exceed 80 columns
- Retitle for net: ipv6, now that the change spans three files
- Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-02ccec50f096@xxxxxxxxx
---
 net/ipv6/ioam6_iptunnel.c |  8 ++++++--
 net/ipv6/rpl_iptunnel.c   |  4 +++-
 net/ipv6/seg6_iptunnel.c  | 12 +++++++++---
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index cfb2c41634a0..4fc745f78eaf 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
 
 	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -303,7 +305,9 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
 	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
 	len = sizeof(*hdr) + hdrlen;
 
-	err = skb_cow_head(skb, len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
index 4e10adcd70e8..69d5c7b61e36 100644
--- a/net/ipv6/rpl_iptunnel.c
+++ b/net/ipv6/rpl_iptunnel.c
@@ -154,7 +154,9 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt,
 
 	hdrlen = ((csrh->hdrlen + 1) << 3);
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err)) {
 		kfree(buf);
 		return err;
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 61c6a27bf202..ed0e8f3ef1f1 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -153,7 +153,9 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
 	hdrlen = (osrh->hdrlen + 1) << 3;
 	tot_len = hdrlen + sizeof(*hdr);
 
-	err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, tot_len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -255,7 +257,9 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb,
 
 	tot_len = red_hdrlen + sizeof(struct ipv6hdr);
 
-	err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, tot_len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -351,7 +355,9 @@ static int __seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
 
 	hdrlen = (osrh->hdrlen + 1) << 3;
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 

---
base-commit: 9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed
change-id: 20260917-seg6-maclen-headroom-53a339c17dac

Best regards,
--  
Yuya Kusakabe <yuya.kusakabe@xxxxxxxxx>