ipv6: fix potential UAF caused by ip6_forward_proxy_check()

ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.

Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.

Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 1f2a33fbed6e630afbdfcde7f0b215417495fbbb..c14adcdd43960ddd8856a7ab2f9775589a4f79c0 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -468,6 +468,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
                default:
                        break;
                }
+               hdr = ipv6_hdr(skb);
        }
 
        /*
@@ -582,6 +583,8 @@ int ip6_forward(struct sk_buff *skb)
        if (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
            pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev)) {
                int proxied = ip6_forward_proxy_check(skb);
+
+               hdr = ipv6_hdr(skb);
                if (proxied > 0) {
                        /* It's tempting to decrease the hop limit
                         * here by 1, as we do at the end of the