[PATCH net 3/5] net: openvswitch: use skb_set_transport_header_careful() in parse_ipv6hdr()

[Eric Dumazet <edumazet@kernel.org>]

skb->transport_header is a 16-bit offset from skb->head, and U16_MAX is
reserved as the "not set" value. skb_set_transport_header() silently
truncates an offset that does not fit.

parse_ipv6hdr() stores the payload offset found by ipv6_find_hdr(),
which depends on the extension headers found in the packet. Should the
value be truncated, key_extract_l3l4() would parse the L4 header at the
wrong place.

Since commit 3744b0964d52 ("ipv6: Implement limits on extension header
parsing") a single chain is bounded to IP6_MAX_EXT_HDRS_CNT headers
(24576 bytes), so this needs a large skb->data - skb->head on top of it,
for instance after several nested decapsulations, each of them possibly
pulling its own extension header chain. No reproducer was written,
this is hardening.

Use skb_set_transport_header_careful() and return -EPROTO if the offset
can not be stored. As for other ipv6_find_hdr() failures, the caller
then sets the transport header to the network header and does not
parse L4. While at it, use payload_ofs directly, since
nh_ofs + nh_len == payload_ofs.

Fixes: 1a37e412a022 ("net: Use 16bits for *_headers fields of struct skbuff")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 net/openvswitch/flow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 3734416b518d..5fbeb0cca9dc 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -438,7 +438,8 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
 		return -EPROTO;
 
 	nh_len = payload_ofs - nh_ofs;
-	skb_set_transport_header(skb, nh_ofs + nh_len);
+	if (unlikely(!skb_set_transport_header_careful(skb, payload_ofs)))
+		return -EPROTO;
 	key->ip.proto = nexthdr;
 	return nh_len;
 }
-- 
2.53.0