Re: [PATCH net v2] ila: reload IPv6 header after pskb_may_pull in checksum adjust

[Simon Horman]

On Tue, Jul 14, 2026 at 07:49:03AM -0400, Michael Bommarito wrote:
> ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling
> pskb_may_pull(). On a non-linear skb whose transport header sits in a page
> fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head()
> and free the old skb head, leaving ip6h dangling; the following
> get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()
> uses ip6h (and the iaddr derived from it) again after the csum-adjust
> call and additionally writes the new locator through that pointer.
> 
> Impact: a remote IPv6 packet routed through a configured ILA
> csum-adjust-transport route or receive-side mapping triggers a
> slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or
> mapping requires CAP_NET_ADMIN to configure, but trigger packets are
> unauthenticated once it exists.
> 
> Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()
> before the csum-diff read. In ila_update_ipv6_locator() only the
> ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in
> that case alone before the destination-address write; the neutral-map
> modes never pull and keep their cached pointers.
> 
> Fixes: 33f11d16142b ("ila: Create net/ipv6/ila directory")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>
> ---
> v2: In ila_update_ipv6_locator() reload ip6h/iaddr only in the
>     ILA_CSUM_ADJUST_TRANSPORT case instead of unconditionally, per
>     Antoine Tenart's review; the neutral-map modes never pull the skb,
>     so their cached pointers remain valid.
> v1: https://lore.kernel.org/netdev/20260711150648.2915106-1-michael.bommarito@xxxxxxxxx/
> 
> Evidence: a KUnit case on UML+KASAN drives ila_update_ipv6_locator()
> with a non-linear skb whose transport header sits in a fragment, so the
> pskb_may_pull() in ila_csum_adjust_transport() reallocates the head.
> Stock: BUG: KASAN: slab-use-after-free in ila_update_ipv6_locator, Read of
> size 4 (the stale ip6h/iaddr). Patched: both the valid-linear control and
> the fragmented case pass, KASAN-clean. Built clean, no new warnings.

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>