[PATCH] xfrm: validate ihl in xfrm4_transport_output()

[Qihang <q.h.hack.winter@gmail.com>]

xfrm4_transport_output() reads the IPv4 header length (ihl) from the
packet and uses it for __skb_pull() and memmove() without checking it
against skb->len, so a frame with ihl * 4 > skb->len underflows skb->len
to a huge value.

Packets injected into an xfrm interface (e.g. AF_PACKET on an xfrmi
device) reach xfrm output without the pskb_may_pull(ihl * 4) check that
ip_rcv_core() applies to received traffic.  The underflowed length then
flows into esp_output() and the crypto scatterlist setup, where every
length in the underflow window ends in a fatal fault (BUG_ON in
__skb_to_sgvec(), or a wild scatterlist access in the crypto layer).
This is a deterministic local denial of service reachable by an
unprivileged user through a user and network namespace.

xfrm6_transport_output() bounds the header length via
xfrm6_hdr_offset() and the IPv4 tunnel/BEET paths use the constant
XFRM_MODE_SKB_CB(skb)->ihl; only IPv4 transport uses the live,
unvalidated value.  Reject the packet when ihl exceeds skb->len.

Fixes: b59f45d0b2878 ("[IPSEC] xfrm: Abstract out encapsulation modes")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
---
 net/xfrm/xfrm_output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -66,6 +66,9 @@ static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
 	struct iphdr *iph = ip_hdr(skb);
 	int ihl = iph->ihl * 4;
 
+	if (ihl > skb->len)
+		return -EINVAL;
+
 	if (!skb->inner_protocol)
 		skb_set_inner_transport_header(skb,
 					       skb_transport_offset(skb));
-- 
2.46.0