[PATCH net v4 2/2] amt: make the head writable before rewriting the L2 header
From: Michael Bommarito <hidden>
Date: 2026-07-07 19:32:59
Also in:
lkml
Subsystem:
amt (automatic multicast tunneling), networking drivers, the rest · Maintainers:
Taehee Yoo, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
amt_multicast_data_handler(), amt_membership_query_handler() and
amt_update_handler() rewrite the ethernet header of the decapsulated
skb in place (eth->h_proto, eth->h_dest and, for the query, also
eth->h_source) before handing it up the stack. The skb head may be
shared, for example when a packet tap has cloned it on the underlay
interface, so writing through it corrupts the other reader's copy.
Call skb_cow_head() before the rewrite so the head is private. It is
placed before the pointers into the head are (re-)derived, so a
reallocation caused by the copy is picked up by those derivations.
Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <redacted>
---
drivers/net/amt.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 1d6b2de4b73cc..f7375e40bc8f2 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c@@ -2330,6 +2330,12 @@ static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb) skb_reset_mac_header(skb); skb_pull(skb, sizeof(*eth)); + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; + if (!pskb_may_pull(skb, sizeof(*iph))) return true; iph = ip_hdr(skb);
@@ -2413,6 +2419,11 @@ static bool amt_membership_query_handler(struct amt_dev *amt, eth = eth_hdr(skb); /* Snapshot the outer source MAC before a later pull can free it. */ ether_addr_copy(h_source, oeth->h_source); + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; if (!pskb_may_pull(skb, sizeof(*iph))) return true;
@@ -2538,6 +2549,12 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) if (!pskb_may_pull(skb, sizeof(*iph))) return true; + /* The L2 header is rewritten below; make the head private first so a + * cloned skb (for example one taken by a packet tap) is not modified. + */ + if (skb_cow_head(skb, 0)) + return true; + iph = ip_hdr(skb); if (iph->version == 4) { if (ip_mc_check_igmp(skb)) {
--
2.53.0