On Wed, Nov 04, 2026 at 05:27:23PM +0800, Hangbin Liu wrote:
From: Hangbin Liu <redacted>
ioam6_do_inline() and ioam6_do_encap() stored the next header into
the shared ilwt->tuninfo template and then memcpy()ed it into the
skb. The lwtstate is used from multiple CPUs without locking, so
another packet can overwrite eh.nexthdr between the store and the
memcpy.
The packet can then leave with an HBH nexthdr that does not match its
payload (e.g. TCP labelled as UDP, or a local packet labelled
IPPROTO_IPV6). Set nexthdr on the per-packet Hop-by-Hop copy after
memcpy instead, leave the shared template read-only.
Fixes: 3edede08ff37 ("ipv6: ioam: Support for IOAM injection with lwtunnels")
This patch should also
Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation")
Hangbin