[PATCH net 1/1] net/sched: sch_cake: validate 6in4 inner headers
From: Ren Wei <hidden>
Date: 2026-07-27 17:03:54
Subsystem:
cake qdisc, networking [general], tc subsystem, the rest · Maintainers:
Toke Høiland-Jørgensen, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim, Jiri Pirko, Linus Torvalds
From: Zhiling Zou <redacted>
CAKE's ACK filter special-cases IPv4 packets carrying IPv6 to find TCP
ACKs inside 6in4 tunnels. The parser checks the outer IPv4 protocol and
the inner next-header field, but it does not verify that the inner
header is actually IPv6.
A malformed packet can therefore use an inner header with a non-IPv6
version while still setting the byte used as nexthdr to TCP. When two
packets from the same queued flow reach cake_ack_filter(), the version
dispatch can fall through to WARN_ON(1), which becomes a denial of
service on kernels with panic_on_warn enabled.
Reject 6in4 packets unless the encapsulated header has IPv6 version 6
in both IP and TCP header parsing helpers.
Fixes: 8b7138814f29 ("sch_cake: Add optional ACK filter")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <redacted>
Signed-off-by: Ren Wei <redacted>
---
net/sched/sch_cake.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 505f63fecf640..7c4d92cdf514f 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c@@ -950,16 +950,19 @@ static struct iphdr *cake_get_iphdr(const struct sk_buff *skb, if (!iph) return NULL; - if (iph->version == 4 && iph->protocol == IPPROTO_IPV6) - return skb_header_pointer(skb, offset + iph->ihl * 4, - sizeof(struct ipv6hdr), buf); + if (iph->version == 4 && iph->protocol == IPPROTO_IPV6) { + iph = skb_header_pointer(skb, offset + iph->ihl * 4, + sizeof(struct ipv6hdr), buf); + if (!iph || iph->version != 6) + return NULL; - else if (iph->version == 4) return iph; - - else if (iph->version == 6) + } else if (iph->version == 4) { + return iph; + } else if (iph->version == 6) { return skb_header_pointer(skb, offset, sizeof(struct ipv6hdr), buf); + } return NULL; }
@@ -990,7 +993,8 @@ static struct tcphdr *cake_get_tcphdr(const struct sk_buff *skb, ipv6h = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); - if (!ipv6h || ipv6h->nexthdr != IPPROTO_TCP) + if (!ipv6h || ipv6h->version != 6 || + ipv6h->nexthdr != IPPROTO_TCP) return NULL; offset += sizeof(struct ipv6hdr);
--
2.43.0