From: Eric Dumazet edumazet@google.com

mainline inclusion from mainline-v6.11-rc5 commit da273b377ae0d9bd255281ed3c2adb228321687b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZO CVE: CVE-2024-44986

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-------------------------------------------

If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed.

We need to hold rcu_read_lock() to make sure the dst and associated idev are alive.

Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet edumazet@google.com Cc: Vasily Averin vasily.averin@linux.dev Reviewed-by: David Ahern dsahern@kernel.org Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski kuba@kernel.org

Conflicts: net/ipv6/ip6_output.c [The conflict occurs because the commit e415ed3a4b8b ipv6: use skb_expand_head in ip6_finish_output2") is not merged] Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com --- net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6d9571cb..153e906 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } skb = nskb; } + /* Make sure idev stays alive */ + rcu_read_lock(); if (skb && pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { kfree_skb(skb); @@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * } if (!skb) { IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); + rcu_read_unlock(); return -ENOMEM; } + rcu_read_unlock(); }

if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {