From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792774570; b=sx61EOR7h3abhGmnZIPJ8fZiien0wsBatmxQNjnXWVRpL0A0Rrqn2jrgri9q3VwWq7Eh eXh01eVaBn9xyQ6dOd3B1jWN7p9+Np1gACrrJvbC0ETiyFuytoXfWQqlE06/s3OxtoNTI AlHA8PZcmPwMYzkKrS2Wg7je8+w21MiX1mXwV7ozoW8Atnf0iCkALg5GzhJB77PM8ks8t 1hgAj0XsPTf3LYOnyjlds/YhVn7Eh8OAHzPbvo54Fl/FK+4x+Tduangpg+orZcSMiqgWw VGi6bNDq/O/tWvLe6/wymNIafXiPKPTW9bYt2aidKHXqtXu9Z7MlyHTkADlJEOHCzZA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792774570; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=t0CnzxOTt0l9mdwFNXCzYBfClSf7+o8Paddgqqwai64=; b=Kww00czrUqFGb96Xy1PTJV0j3ma8zL31qRpWhvoyuofLqnuy3vwT6fJ3n5ABVHMMljUb 9Sy6rM3TDMlaCTiLLXQGaA75WYd0YgyLZqHkZC4c5kCGw09smCF3SSGJNDr8pSkLaf8cr QezC8pZY31PHQRbRWSxLsszUgLqIYbtclW1tyWuYmsKY/DGgGBlxWgCWY5JM3gObbWlkj nfb0FGXSorhlIMb7jbWr4RbQpRiuzzUM8ez7eeOwMD9skYXqurXoGdDuqAkk6/I3fCqD5 7VqXvnh+z7EV1d4XqawBa69Te3PN3yKvDJSWUmQiEsdmN4X/7k67nNjj0akdTjs3X+A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bEsloqMX; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F9A2606A31A; Fri, 23 Oct 2026 16:56:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bEsloqMX Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3DC91F01825; Fri, 23 Oct 2026 16:56:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792774570; bh=t0CnzxOTt0l9mdwFNXCzYBfClSf7+o8Paddgqqwai64=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bEsloqMXUYJCFTfN60Iyakz4mdQGeJYyvtrHGkAPRVA/RD0YOtdWeuvpGQXDAzDCr djtCMl09Mlw8eQcXXIcXjf2sY4PzMPykoVc6mfJCjXVxrku+p+GAPfktOB40/4/gul gDoT46zAyIHMMuEKxbgWVnKvgLZVmwXSA455ROUA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Eric Dumazet , Wang Zhan , Joas Antonio dos Santos , Paul Moore , Paolo Abeni , Sasha Levin Subject: [PATCH 7.2 084/242] calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() Date: Fri, 23 Oct 2026 18:38:46 +0200 Message-ID: <20261023163715.764341975@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261023163713.816071858@linuxfoundation.org> References: <20261023163713.816071858@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joas Antonio dos Santos [ Upstream commit 8070ed578b6b9134e045627fb745c887a806d46e ] calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload = ntohs(ip6_hdr->payload_len); ip6_hdr->payload_len = htons(payload + len_delta); GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores payload_len == 0 for them; ipv6_payload_len() then falls back to skb->len. For such a packet forwarded to a destination mapped to CALIPSO, the code above writes len_delta (or 65536 + len_delta when shrinking) into payload_len, and ipv6_payload_len() no longer falls back to skb->len. nf_tables, conntrack and sch_cake rely on it. The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN, and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its real length back. Set payload_len from the skb length with ipv6_set_payload_len(), which stores 0 above IPV6_MAXPLEN and the real length otherwise, as ipv6_gro_complete() does. The network header was just reset to skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length. Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal mdp-generated policy (network_peer_controls=1), "netlabelctl calipso add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO DOI 16. calipso_skbuff_setattr() was called through netlbl_skbuff_setattr() from a test-only debugfs hook (not part of this patch) adding a level-only label; payload_len after the call: case before fix after fix real length 1000, unlabeled 1016 1016 1016 70000 GSO, payload_len 0 16 0 70016 65530 GSO, grows past MAXPLEN 10 0 65546 65540 GSO with a 24 byte hop header, shrinks below MAXPLEN 65528 65532 65532 1000 with a 24 byte hop header 992 992 992 (0 means ipv6_payload_len() returns the real length.) On the forward path, with a client injecting unlabeled UDP through a router to a server, the router adds the CALIPSO option and the server delivers all datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch. Fixes: 81fbc812132c ("ipv6/gro: insert temporary HBH/jumbo header") Suggested-by: Eric Dumazet Suggested-by: Wang Zhan Signed-off-by: Joas Antonio dos Santos Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Wang Zhan Acked-by: Paul Moore Link: https://patch.msgid.link/179156155963.36253.400481753322266658@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- net/ipv6/calipso.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index c6a34334e657e..a0192b4fef334 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -1318,7 +1318,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, struct ipv6hdr *ip6_hdr; struct ipv6_opt_hdr *hop; unsigned char buf[CALIPSO_MAX_BUFFER]; - int len_delta, new_end, pad, payload; + int len_delta, new_end, pad; unsigned int start, end; ip6_hdr = ipv6_hdr(skb); @@ -1357,8 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, sizeof(*ip6_hdr) + start); skb_reset_network_header(skb); ip6_hdr = ipv6_hdr(skb); - payload = ntohs(ip6_hdr->payload_len); - ip6_hdr->payload_len = htons(payload + len_delta); + /* 0 above IPV6_MAXPLEN (BIG TCP), the real length otherwise */ + ipv6_set_payload_len(ip6_hdr, skb->len - sizeof(*ip6_hdr)); } hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1); -- 2.53.0