Re: [PATCH net] calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] calipso: skips payload_len update for non-GSO empty packets
--

commit 453f949afc807f64bbb4a0d488ed6f38254f5d88
Author: Joas Antonio dos Santos <joasantonio108@gmail.com>

calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

This commit prevents calipso_skbuff_setattr() from modifying payload_len
for BIG TCP packets, which natively use a payload_len of 0. It avoids
overwriting the 0 value when adjusting the length for CALIPSO options,
ensuring that ipv6_payload_len() falls back to skb->len properly.

> diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
> index c6a34334e657e..dfea7ed65afc4 100644
> --- a/net/ipv6/calipso.c
> +++ b/net/ipv6/calipso.c
[ ... ]
> @@ -1357,8 +1357,9 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
>  			sizeof(*ip6_hdr) + start);
>  		skb_reset_network_header(skb);
>  		ip6_hdr = ipv6_hdr(skb);
> -		payload = ntohs(ip6_hdr->payload_len);
> -		ip6_hdr->payload_len = htons(payload + len_delta);
> +		/* BIG TCP packets have payload_len == 0 */
> +		if (ip6_hdr->payload_len)
> +			be16_add_cpu(&ip6_hdr->payload_len, len_delta);

[Severity: Medium]
Does this conditional skip updating payload_len for non-GSO empty IPv6
packets when adding CALIPSO options?

If a user application sends a 0-byte payload using an IPv6 raw socket
(e.g., IPPROTO_NONE), and a SELinux NetLabel policy applies CALIPSO to the
socket, the NF_INET_LOCAL_OUT hook triggers calipso_skbuff_setattr().

The function will insert the CALIPSO option but leave payload_len as 0.

This results in a packet being transmitted with an IPv6 payload_len of 0
but without a Jumbo Payload option, which RFC 8200 compliant receivers
will discard as malformed.

On a Linux host, this causes ip6_rcv_core() to skip trimming the SKB,
mistakenly passing L2 padding up to the receiving application as payload
data.

>  	}
>  
>  	hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179147330473.58090.15760316487710432833@gmail.com?part=1