Messages in this thread | | | Date | Wed, 8 Dec 2021 20:23:23 -0700 | Subject | Re: [net] seg6: fix the iif in the IPv6 socket control block | From | David Ahern <> |
| |
On 12/8/21 12:54 PM, Andrea Mayer wrote: > When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving > interface index into the IPv4 socket control block (v5.16-rc4, > net/ipv4/ip_input.c line 510): > > IPCB(skb)->iif = skb->skb_iif; > > If that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH > header, the seg6_do_srh_encap(...) performs the required encapsulation. > In this case, the seg6_do_srh_encap function clears the IPv6 socket control > block (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163): > > memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); > > The memset(...) was introduced in commit ef489749aae5 ("ipv6: sr: clear > IP6CB(skb) on SRH ip4ip6 encapsulation") a long time ago (2019-01-29). > > Since the IPv6 socket control block and the IPv4 socket control block share > the same memory area (skb->cb), the receiving interface index info is lost > (IP6CB(skb)->iif is set to zero). > > As a side effect, that condition triggers a NULL pointer dereference if > commit 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig > netdev") is applied. > > To fix that issue, we set the IP6CB(skb)->iif with the index of the > receiving interface once again. > > Fixes: ef489749aae5 ("ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation") > Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> > --- > net/ipv6/seg6_iptunnel.c | 8 ++++++++ > 1 file changed, 8 insertions(+) >
Reviewed-by: David Ahern <dsahern@kernel.org>
| |