Re: [PATCH net] net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys
From: Fernando Fernandez Mancera
Date: Wed Oct 21 2026 - 09:46:47 EST
On 10/21/26 8:42 AM, Tariq Toukan wrote:
From: Gal Pressman <gal@xxxxxxxxxx>Reviewed-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>
mlx5e_ipsec_netevent_event() keeps the L2 headers of offloaded tunnel
mode SAs up to date: on every neighbour change it looks for SAs whose
endpoint matches the neighbour's address. The compare width, 4 bytes for
IPv4 or 16 for IPv6, is chosen from the SA's address family, with no
check that the neighbour is of the same family.
An ARP entry only stores a 4-byte key, so with an IPv6 tunnel mode SA
offloaded, any IPv4 neighbour update in the system is compared as if it
were a 16-byte IPv6 address, reading past the end of the object:
BUG: KASAN: slab-out-of-bounds in mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
Read of size 4 at addr ff110001260a4ad8 by task swapper/8/0
Call Trace:
<IRQ>
mlx5e_ipsec_netevent_event+0x736/0x8d0 [mlx5_core]
notifier_call_chain+0x97/0x2b0
atomic_notifier_call_chain+0x5d/0x130
neigh_timer_handler+0x35c/0x1140
call_timer_fn+0x164/0x490
__run_timers+0x5b9/0x960
run_timer_softirq+0xf0/0x1d0
handle_softirqs+0x189/0x8a0
__irq_exit_rcu+0x10d/0x250
...
Allocated by task 1015:
__kmalloc_noprof+0x2e6/0x8b0
___neigh_create+0xcc9/0x24c0
ip_finish_output2+0xfc7/0x1e80
ip_output+0x172/0x3b0
ip_send_skb+0xa5/0x1b0
udp_send_skb+0x852/0x10f0
udp_sendmsg+0x1333/0x2150
...
The opposite mix (IPv4 SA with IPv6 neighbour) stays in bounds, but only
the first 32 bits of the IPv6 address are compared, so an unrelated
neighbour can match.
Skip neighbours whose address family doesn't match the SA.
Fixes: 4c24272b4e2b ("net/mlx5e: Listen to ARP events to update IPsec L2 headers in tunnel mode")
Signed-off-by: Gal Pressman <gal@xxxxxxxxxx>
Reviewed-by: Leon Romanovsky <leonro@xxxxxxxxxx>
Reviewed-by: Yael Chemla <ychemla@xxxxxxxxxx>
Signed-off-by: Tariq Toukan <tariqt@xxxxxxxxxx>