kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Fabian Bläse b4c1876454 icmp: fix icmp_ndo_send address translation for reply direction 
[ Upstream commit c6dd1aa2cb ]

The icmp_ndo_send function was originally introduced to ensure proper
rate limiting when icmp_send is called by a network device driver,
where the packet's source address may have already been transformed
by SNAT.

However, the original implementation only considers the
IP_CT_DIR_ORIGINAL direction for SNAT and always replaced the packet's
source address with that of the original-direction tuple. This causes
two problems:

1. For SNAT:
   Reply-direction packets were incorrectly translated using the source
   address of the CT original direction, even though no translation is
   required.

2. For DNAT:
   Reply-direction packets were not handled at all. In DNAT, the original
   direction's destination is translated. Therefore, in the reply
   direction the source address must be set to the reply-direction
   source, so rate limiting works as intended.

Fix this by using the connection direction to select the correct tuple
for source address translation, and adjust the pre-checks to handle
reply-direction packets in case of DNAT.

Additionally, wrap the `ct->status` access in READ_ONCE(). This avoids
possible KCSAN reports about concurrent updates to `ct->status`.

Fixes: 0b41713b60 ("icmp: introduce helper for nat'd source address in network device context")
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-09-09 18:54:14 +02:00
..
ila net: Fix checksum update for ILA adj-transport 2025-06-27 11:07:38 +01:00
netfilter netfilter: nf_reject: don't leak dst refcount for loopback packets 2025-08-28 16:26:19 +02:00
addrconf.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-28 16:25:56 +02:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-02-05 20:13:01 +00:00
addrlabel.c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 2022-11-07 12:26:15 +00:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-12-14 19:54:41 +01:00
ah6.c xfrm: ah: add extack to ah_init_state, ah6_init_state 2022-09-29 07:17:59 +02:00
anycast.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-07-30 16:30:55 -07:00
calipso.c calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). 2025-06-27 11:07:40 +01:00
datagram.c ipv6: Fix datagram socket connection with DSCP. 2023-02-22 12:59:54 +01:00
esp6.c espintcp: remove encap socket caching to avoid reference leak 2025-06-04 14:40:19 +02:00
esp6_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 11:12:29 +02:00
exthdrs.c Fix write to cloned skb in ipv6_hop_ioam() 2024-03-01 13:26:38 +01:00
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-30 14:03:21 +01:00
exthdrs_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
fib6_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib6_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-06-04 14:40:15 +02:00
fou6.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
icmp.c inetpeer: do not get a refcount in inet_getpeer() 2025-02-21 13:49:01 +01:00
inet6_connection_sock.c lsm,selinux: pass flowi_common instead of flowi to the LSM hooks 2020-11-23 18:36:21 -05:00
inet6_hashtables.c net: remove duplicate reuseport_lookup functions 2024-06-12 11:03:12 +02:00
ioam6.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
ioam6_iptunnel.c ipv6: ioam: block BH from ioam6_output() 2024-06-21 14:35:33 +02:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:05:00 +02:00
ip6_flowlabel.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
ip6_gre.c net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
ip6_icmp.c icmp: fix icmp_ndo_send address translation for reply direction 2025-09-09 18:54:14 +02:00
ip6_input.c ipv6: annotate data-races around cnf.disable_ipv6 2024-05-17 11:56:13 +02:00
ip6_offload.c ipv6: reject malicious packets in ipv6_gso_segment() 2025-08-15 12:05:10 +02:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c Revert "ipv6: save dontfrag in cork" 2025-07-06 10:58:04 +02:00
ip6_tunnel.c net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
ip6_udp_tunnel.c net: Make locking in sock_bindtoindex optional 2020-06-01 14:57:14 -07:00
ip6_vti.c net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
ip6mr.c net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain 2025-08-15 12:04:56 +02:00
ipcomp6.c xfrm: ipcomp: add extack to ipcomp{4,6}_init_state 2022-09-29 07:18:00 +02:00
ipv6_sockglue.c net: use unrcu_pointer() helper 2024-12-14 19:53:33 +01:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-10-17 15:21:13 +02:00
Makefile net: ipv6: use ipv6-y directly instead of ipv6-objs 2021-09-28 13:13:40 +01:00
mcast.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-28 16:25:56 +02:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-04-27 14:02:06 -07:00
mip6.c xfrm: mip6: add extack to mip6_destopt_init_state, mip6_rthdr_init_state 2022-09-29 07:18:01 +02:00
ndisc.c ndisc: extend RCU protection in ndisc_send_skb() 2025-02-21 13:50:08 +01:00
netfilter.c netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-27 11:07:10 +01:00
output_core.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
ping.c net: annotate data-races around sk->sk_tsflags 2024-01-10 17:10:23 +01:00
proc.c icmp: Add counters for rate limits 2024-10-17 15:21:27 +02:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c net: annotate data-races around sk->sk_tsflags 2024-01-10 17:10:23 +01:00
reassembly.c net: ipv6: fix wrong start position when receive hop-by-hop fragment 2024-06-12 11:03:18 +02:00
route.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:05:00 +02:00
rpl.c net: rpl: fix rpl header size calculation 2023-04-26 14:28:34 +02:00
rpl_iptunnel.c rpl: Fix use-after-free in rpl_do_srh_inline(). 2025-07-24 08:51:51 +02:00
seg6.c ipv6: sr: fix invalid unregister error path 2024-06-12 11:03:19 +02:00
seg6_hmac.c ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add 2025-08-28 16:26:18 +02:00
seg6_iptunnel.c net: ipv6: fix dst ref loop on input in seg6 lwt 2025-03-07 16:56:46 +01:00
seg6_local.c seg6: Fix validation of nexthop addresses 2025-06-27 11:07:18 +01:00
sit.c net: add netdev_lockdep_set_classes() to virtual drivers 2025-08-28 16:26:10 +02:00
syncookies.c dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:52:16 +01:00
sysctl_net_ipv6.c net: sysctl: introduce sysctl SYSCTL_THREE 2022-05-03 10:15:06 +02:00
tcp_ipv6.c net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:17:17 +01:00
tcpv6_offload.c net: move gro definitions to include/net/gro.h 2021-11-16 13:16:54 +00:00
tunnel6.c tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels 2020-07-09 12:52:37 +02:00
udp.c udp: gso: do not drop small packets when PMTU reduces 2025-02-21 13:49:36 +01:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2022-10-12 17:50:37 -07:00
udp_offload.c gso: fix dodgy bit handling for GSO_UDP_L4 2024-08-29 17:30:54 +02:00
udplite.c udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). 2023-05-30 14:03:20 +01:00
xfrm6_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:56:10 +02:00
xfrm6_output.c xfrm: fix tunnel model fragmentation behavior 2022-03-01 12:08:40 +01:00
xfrm6_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-11-01 01:56:03 +01:00
xfrm6_protocol.c xfrm: add support for UDPv6 encapsulation of ESP 2020-04-28 11:28:36 +02:00
xfrm6_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c xfrm: tunnel: add extack to ipip_init_state, xfrm6_tunnel_init_state 2022-09-29 07:18:00 +02:00