From nobody Fri Sep 25 00:40:31 2026 Received: from mail-pj2-f43.google.com (mail-pj2-f43.google.com [74.125.227.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B663A396B98 for ; Fri, 18 Sep 2026 01:28:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789694918; cv=none; b=XSqRAymIZ5zaI5DY4pzshiI65JEq4kkFaAB/HnBM1qn+mmMeMvlIYNUs130tz+3j0YnOUUCR9I9Ki863iUhBSFi2rfjsAtBGOuNaYfwX48yhVUSLt1zBF3K4KLKiq6muY+5aaV9JVKbJbosn4UsdeWWWtPPaS4i9d0LiAPxRoEw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789694918; c=relaxed/simple; bh=Ea1aNPnDh7eYv/LKozZEW8Ct+6DzW2Xa4aTSnQ4yj/c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=cUTo0C7ATtdFC5o/iPA+HQRuaNEHi0XEX++sY5TeGBg5/vJ3ckRX4NueB5WyPkqjVlRdvdAcrMUsFd9kaNl5znrlPct+hSseBDHcHqZaL9rL5DghizpDjUhwtxYf2wLNnXsxts7Xa1Rfa76D2Cu8iU/Q+dAX2bkvjv5n88vi+qM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RGgjdS2R; arc=none smtp.client-ip=74.125.227.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RGgjdS2R" Received: by mail-pj2-f43.google.com with SMTP id 98e67ed59e1d1-39e03468a5fso237426a91.0 for ; Thu, 17 Sep 2026 18:28:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789694911; x=1790299711; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6FWo0FHn7Bo/KTGHYNGQsEOiCj/c++P+vjdoJVT5D3s=; b=RGgjdS2RT0uawIZa7CdVJjhBn0IipBMEcTBW+3uV0MSeO8i/L44D+vIycTiZpzttnb R29xg2fBuo2HuNiMeqeeu4gq2AcdBIFY7zu82C5nd/3Bxrg1HNEXVKaVcVHJVWrbQHVC WzbNAklOowf1DkwKVMbmuaKAEsX0TcFSuBHskH1L5cTD2J32RqlZ4Z6XxYI3pWvWS8n8 xJvrI1jUisHTHRI1eTH3Bg408ThnvHI41xpkWPnh6cNKgPlG1w5lieuIsJv70c5ubnMY rzRIwtGxIB8PvoDl85Ry9+IMYsLanUJpSNfUBgIVaDG/Wkno51PuHggMDVPPdc6kyY1R IMwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789694911; x=1790299711; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6FWo0FHn7Bo/KTGHYNGQsEOiCj/c++P+vjdoJVT5D3s=; b=NjMGgQUPi4H9YNuI6B7+s+hlgPj1PHAgyR4GvITTY5+h975RkngywqY20sOuL+tl3x WAnR8ZCqhF2wlZo/H1I7tNOJchV1Wt1BFqfML1skH4Hk4rhT1SKFYnkkbZxeWbKJ/sFr pyhuhNq2TxDP9COiHk+k6iNYpS296RqHNAOga8lLjFBCrrZOj4KzYDAKOjdV1X56kfX9 2VzSLucFsgv9ZICR8pGTLaAj8iV4BvQkRLB9O0GVslWAP6iF7OAUYOY6NPsOzLNqFzLg eT/1vkT+6MV10TMB7iKq8BpJKlAowP/vwbBRWFVbh1uYeshombbLEolEfJBCz5sT7Ghn g87Q== X-Forwarded-Encrypted: i=1; AKwUvBygNneEQirenWqubHs/aRIWdCS3L95y0uOcY0nxbGNkq5bnhq4bwQGaRiLwbgnUXRHi9/8bn8+yu0zHv4U=@vger.kernel.org X-Gm-Message-State: AFuF++l2GTkGlMH3LSoyMntsMtqqHZTazqKSMmcNR4fneOSFqJmTuIVu hEMxDc5K8JV8XeqXlnsWF6Lfo3hNIdcmapVCPKgxvKLK0vj7hpdyH3+u X-Gm-Gg: AYBFou0Qcv4rT3foqaGxx7QAWkgiqdAyLIiZGq02fUqoPwKUGDkaQZy944j2vYs9iHv cEI/TjVKID/ozD+R0TgwmWxak5J5y0zVl0ov784KFuFXxmldQeJl/qlaP/8VHS1UVjAh3G6uyBu o2GSr0B1Hj0yj2r7dBpH6JG+9GqZByH32QQtSXCVzMBxO3441gCqS/kluUPDHuu6FUdWzjZ4a2F AmJjlTiRHCVWnR8gemCSK7jInA6mSvWYG9VJKd7XGTkvQUNC3bX2VASs63n92evbLvtZTs49e6k YRCGG7WAKVFpdObAjeNiumwca4OC7jiFAxAWr/V7Bvmyva7fA42vPl9DKZTwsODkMTaSbebXVp2 aJmmvJiPoD7Yicy2bUgSXqKHDHhD4o6aTiww4fbaiM87SPwQ3mUqPg0qKD1GOIKNF7oRzh8SHoP npeZdG2hlPFG7byHYx83N+wVYeRJMemJIbpi5MnwOwu89kxM8wXExGsn5eDKvBuma4tsJeVq+wr WX6GCsZ6A== X-Received: by 2002:a17:90b:2f04:b0:39b:3109:10ce with SMTP id 98e67ed59e1d1-39e54c9c1admr2049084a91.16.1789694910798; Thu, 17 Sep 2026 18:28:30 -0700 (PDT) Received: from [163.43.103.131] ([163.43.103.131]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39e50a4bc22sm2108427a91.17.2026.09.17.18.28.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Sep 2026 18:28:30 -0700 (PDT) From: Yuya Kusakabe Date: Fri, 18 Sep 2026 10:28:27 +0900 Subject: [PATCH net v2] net: ipv6: keep room for the mac header when growing the headroom Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260918-seg6-maclen-headroom-v2-1-4d370af55b2e@gmail.com> X-B4-Tracking: v=1; b=H4sIALuTrGoC/32NwQ6CMBBEf4Xs2TVtCRA8+R+GQ10WWENb0yLRE P5dwLvHmbx5s0DiKJzgki0QeZYkwW/BnDKgwfqeUdotg1GmVLWuMHFforM0sseBbRtDcFjkNs9 r0lVrCbbpM3In70N7A88TNL8yve4PpmkX7tggaQrxc5zP+oD//8waNSpDxFSoTtXltXdWxjMFB 826rl+re/aQzwAAAA== X-Change-ID: 20260917-seg6-maclen-headroom-53a339c17dac To: Andrea Mayer , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Justin Iurman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Yuya Kusakabe X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=5251; i=yuya.kusakabe@gmail.com; h=from:subject:message-id; bh=Ea1aNPnDh7eYv/LKozZEW8Ct+6DzW2Xa4aTSnQ4yj/c=; b=owEBbQKS/ZANAwAIASrX0XUqXRtNAcsmYgBqrJO8ZQxhYSaMZG1i8Ws6R5JnPZDXSx+z93Pap hEa36QBNf6JAjMEAAEIAB0WIQTaB7usAfxNKMeqa6Yq19F1Kl0bTQUCaqyTvAAKCRAq19F1Kl0b TR6yD/98e8z6+ZdgeHCI/5Lj5d2SkUB3nivYNcmkdfYCxf5jrtUXNO/StDnF6GC4IrmWRIFy9Wr qZD1ks9v0P7W3yeDjMD028xGi+2s7iGC30TDHoKPbHFkSEFBYPhtw5dKItkhJ5OMgtsrCPSUdOB 8YsSmPoFPMy0nVFPggxQ+gWGT9y5oKTkHqXGXgyMK61OM2w5ZGml9Hb3Qq7fcob8LV67b1zHQaX 4QzDESwcfLY/HpPIT9ERbMCOlJAowhxyOjA0RQpOEgifx1rfYsbSqdYsp/6evFILDiYxxuNhV8L LCKGyIhpZ29gLfq6R5x/1Lxay6o9RuWPlacsV/IFzMAXpYpo18vJ9V51SvIrJPnyhdGNcQ6hZ4/ K0IfQgvlcYwbLc46k+w5/HdN3KD0jzdgp9Szxilrj+ZrxoMRIEueTd/9/7vs9zurr1mzxetVIve W6ep7cIlyWX4RpMrHun4fvNR7CEj0cpMUZOLg5uXpGdyG085EPKGXmLnQMa5U0hvMJHVCgzClPq Wgt4BAj+Yepluaa+pg7WBTT0sOhnGKmW1LjzgNtsZUwqg2ruFCBw1ijjAZcsQXezUKideTUi9xh 5fmAp0bT1KjnpM3eWjgu37AweoGaJyepGwRhy0L3nuxovWoSlcBFv2DBxHjoSDTLEmUYy1g/EVK 3/qvhPpGJY7wPLA== X-Developer-Key: i=yuya.kusakabe@gmail.com; a=openpgp; fpr=DA07BBAC01FC4D28C7AA6BA62AD7D1752A5D1B4D The seg6, ioam6 and rpl lwtunnels all grow the headroom with skb_cow_head(), push their new headers into it, and then rebuild the mac header below them with skb_mac_header_rebuild(). The headroom left after the push has to be at least skb->mac_len for that rebuild, but the requests ask for the pushed length plus dst_dev_overhead(), which leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Ask for whichever of the two is larger. These requests carried skb->mac_len until the egress overhead took its place rather than joining it. Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue") Fixes: dce525185bc9 ("net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue") Fixes: 985ec6f5e623 ("net: ipv6: rpl_iptunnel: mitigate 2-realloc issue") Assisted-by: LLM Signed-off-by: Yuya Kusakabe Reviewed-by: Justin Iurman --- Changes in v2: - Use max_t(unsigned int, ...) rather than max() [Justin] - Make the same change in ioam6_iptunnel and rpl_iptunnel [Justin] - Reproduce and verify the fix on those two as well: unpatched, rpl underflows in 12 of 16 probed configurations and ioam6 in 3 of 13, both reaching about 64 KB past a 320-byte head; patched, neither underflows in 18 - Rewrap the requests so they no longer exceed 80 columns - Retitle for net: ipv6, now that the change spans three files - Link to v1: https://lore.kernel.org/r/20260917-seg6-maclen-headroom-v1-1-= 02ccec50f096@gmail.com --- net/ipv6/ioam6_iptunnel.c | 8 ++++++-- net/ipv6/rpl_iptunnel.c | 4 +++- net/ipv6/seg6_iptunnel.c | 12 +++++++++--- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c index cfb2c41634a0..4fc745f78eaf 100644 --- a/net/ipv6/ioam6_iptunnel.c +++ b/net/ipv6/ioam6_iptunnel.c @@ -262,7 +262,9 @@ static int ioam6_do_inline(struct net *net, struct sk_b= uff *skb, =20 hdrlen =3D (tuninfo->eh.hdrlen + 1) << 3; =20 - err =3D skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 @@ -303,7 +305,9 @@ static int ioam6_do_encap(struct net *net, struct sk_bu= ff *skb, hdrlen =3D (tuninfo->eh.hdrlen + 1) << 3; len =3D sizeof(*hdr) + hdrlen; =20 - err =3D skb_cow_head(skb, len + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c index 4e10adcd70e8..69d5c7b61e36 100644 --- a/net/ipv6/rpl_iptunnel.c +++ b/net/ipv6/rpl_iptunnel.c @@ -154,7 +154,9 @@ static int rpl_do_srh_inline(struct sk_buff *skb, const= struct rpl_lwt *rlwt, =20 hdrlen =3D ((csrh->hdrlen + 1) << 3); =20 - err =3D skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) { kfree(buf); return err; diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 61c6a27bf202..ed0e8f3ef1f1 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -153,7 +153,9 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, str= uct ipv6_sr_hdr *osrh, hdrlen =3D (osrh->hdrlen + 1) << 3; tot_len =3D hdrlen + sizeof(*hdr); =20 - err =3D skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, tot_len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 @@ -255,7 +257,9 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb, =20 tot_len =3D red_hdrlen + sizeof(struct ipv6hdr); =20 - err =3D skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, tot_len + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 @@ -351,7 +355,9 @@ static int __seg6_do_srh_inline(struct sk_buff *skb, st= ruct ipv6_sr_hdr *osrh, =20 hdrlen =3D (osrh->hdrlen + 1) << 3; =20 - err =3D skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, hdrlen + + max_t(unsigned int, skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 --- base-commit: 9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed change-id: 20260917-seg6-maclen-headroom-53a339c17dac Best regards, -- =20 Yuya Kusakabe