1. Patchew
  2. linux
  3. View series

[PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom

Yuya Kusakabe posted 1 patch 6 days, 22 hours ago 
net/ipv6/ioam6_iptunnel.c |  8 ++++++--
net/ipv6/rpl_iptunnel.c   |  4 +++-
net/ipv6/seg6_iptunnel.c  | 12 +++++++++---
3 files changed, 18 insertions(+), 6 deletions(-)
[PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom
Posted by Yuya Kusakabe 6 days, 22 hours ago 
The seg6, ioam6 and rpl lwtunnels all grow the headroom with
skb_cow_head(), push their new headers into it, and then rebuild the mac
header below them with skb_mac_header_rebuild().  The headroom left
after the push has to be at least skb->mac_len for that rebuild, but the
requests ask for the pushed length plus dst_dev_overhead(), which leaves
LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet.

Where the mac header is longer than that, as it is on ingress through a
VLAN device with reorder_hdr off, the rebuild runs out of room:
skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,
stores it unchecked in the u16 skb->mac_header, and the memmove that
follows writes skb->mac_len bytes about 64 KB past skb->head.
Forwarding plain ping6 traffic through such a device reproduces it on
all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;
skb->mac_header comes back as 65534 on a 704-byte head.

Ask for whichever of the two is larger.  These requests carried
skb->mac_len until the egress overhead took its place rather than
joining it.

Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue")
Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue")
Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue")
Assisted-by: LLM
Signed-off-by: Yuya Kusakabe <yuya.kusakabe@gmail.com>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
---
Changes in v2:
- Use max_t(unsigned int, ...) rather than max() [Justin]
- Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin]
- Reproduce and verify the fix on those two as well: unpatched, rpl
  underflows in 12 of 16 probed configurations and ioam6 in 3 of 13,
  both reaching about 64 KB past a 320-byte head; patched, neither
  underflows in 18
- Rewrap the requests so they no longer exceed 80 columns
- Retitle for net: ipv6, now that the change spans three files
- Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-02ccec50f096@gmail.com
---
 net/ipv6/ioam6_iptunnel.c |  8 ++++++--
 net/ipv6/rpl_iptunnel.c   |  4 +++-
 net/ipv6/seg6_iptunnel.c  | 12 +++++++++---
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index cfb2c41634a0..4fc745f78eaf 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
 
 	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -303,7 +305,9 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
 	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
 	len = sizeof(*hdr) + hdrlen;
 
-	err = skb_cow_head(skb, len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
index 4e10adcd70e8..69d5c7b61e36 100644
--- a/net/ipv6/rpl_iptunnel.c
+++ b/net/ipv6/rpl_iptunnel.c
@@ -154,7 +154,9 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const struct rpl_lwt *rlwt,
 
 	hdrlen = ((csrh->hdrlen + 1) << 3);
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err)) {
 		kfree(buf);
 		return err;
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 61c6a27bf202..ed0e8f3ef1f1 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -153,7 +153,9 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
 	hdrlen = (osrh->hdrlen + 1) << 3;
 	tot_len = hdrlen + sizeof(*hdr);
 
-	err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, tot_len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -255,7 +257,9 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb,
 
 	tot_len = red_hdrlen + sizeof(struct ipv6hdr);
 
-	err = skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, tot_len +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 
@@ -351,7 +355,9 @@ static int __seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
 
 	hdrlen = (osrh->hdrlen + 1) << 3;
 
-	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
+	err = skb_cow_head(skb, hdrlen +
+			   max_t(unsigned int, skb->mac_len,
+				 dst_dev_overhead(cache_dst, skb)));
 	if (unlikely(err))
 		return err;
 

---
base-commit: 9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed
change-id: 20260917-seg6-maclen-headroom-53a339c17dac

Best regards,
--  
Yuya Kusakabe <yuya.kusakabe@gmail.com>
Re: [PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom
Posted by Paolo Abeni 2 days, 10 hours ago 
On 9/18/26 03:28, Yuya Kusakabe wrote:
> The seg6, ioam6 and rpl lwtunnels all grow the headroom with
> skb_cow_head(), push their new headers into it, and then rebuild the mac
> header below them with skb_mac_header_rebuild().  The headroom left
> after the push has to be at least skb->mac_len for that rebuild, but the
> requests ask for the pushed length plus dst_dev_overhead(), which leaves
> LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet.
> 
> Where the mac header is longer than that, as it is on ingress through a
> VLAN device with reorder_hdr off, the rebuild runs out of room:
> skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,
> stores it unchecked in the u16 skb->mac_header, and the memmove that
> follows writes skb->mac_len bytes about 64 KB past skb->head.
> Forwarding plain ping6 traffic through such a device reproduces it on
> all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;
> skb->mac_header comes back as 65534 on a 704-byte head.
> 
> Ask for whichever of the two is larger.  These requests carried
> skb->mac_len until the egress overhead took its place rather than
> joining it.
> 
> Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue")
> Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue")
> Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue")
> Assisted-by: LLM
> Signed-off-by: Yuya Kusakabe <yuya.kusakabe@gmail.com>
> Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
> ---
> Changes in v2:
> - Use max_t(unsigned int, ...) rather than max() [Justin]
> - Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin]
> - Reproduce and verify the fix on those two as well: unpatched, rpl
>    underflows in 12 of 16 probed configurations and ioam6 in 3 of 13,
>    both reaching about 64 KB past a 320-byte head; patched, neither
>    underflows in 18
> - Rewrap the requests so they no longer exceed 80 columns
> - Retitle for net: ipv6, now that the change spans three files
> - Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-02ccec50f096@gmail.com
> ---
>   net/ipv6/ioam6_iptunnel.c |  8 ++++++--
>   net/ipv6/rpl_iptunnel.c   |  4 +++-
>   net/ipv6/seg6_iptunnel.c  | 12 +++++++++---
>   3 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
> index cfb2c41634a0..4fc745f78eaf 100644
> --- a/net/ipv6/ioam6_iptunnel.c
> +++ b/net/ipv6/ioam6_iptunnel.c
> @@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
>   
>   	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
>   
> -	err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
> +	err = skb_cow_head(skb, hdrlen +
> +			   max_t(unsigned int, skb->mac_len,
> +				 dst_dev_overhead(cache_dst, skb)));

The above snipped is repeated 6 times verbatim: it's calling loudly for
some deduplication.

Since all the existing dst_dev_overhead() users are touched here, I
suggest moving the max() computation inside dst_dev_overhead().

/P
Re: [PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom
Posted by Yuya Kusakabe 2 days, 9 hours ago 
On 9/22/26 15:46, Paolo Abeni wrote:
> Since all the existing dst_dev_overhead() users are touched here, I
> suggest moving the max() computation inside dst_dev_overhead().

Thanks, that is what v3 does, posted before this mail:

  https://lore.kernel.org/r/20260922-seg6-maclen-headroom-v3-1-7b2f982ef79d@gmail.com

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.