[PATCH net v4 0/2] xfrm: fix IPv6 atomic fragment policy handling

[PATCH net v4 0/2] xfrm: fix IPv6 atomic fragment policy handling

[Jérémy Jean]

This series fixes two IPv6 fragment issues in XFRM session decoding.

Patch 1 restores upper-layer protocol decoding for IPv6 first
fragments.

Patch 2 builds on Patch 1 and restores ports, ICMPv6 type and code,
and GRE keys for atomic fragments, while leaving them unset for real
fragments.

Changes in v4 after a review from Sashiko:
- Patch 1: unchanged.
- Patch 2: Use skb_header_pointer() and remove the XFRM pull to fix
  local input decoding and avoid stale header pointers.

v1: https://lore.kernel.org/all/20261101230745.2043474-2-Jeremy.Jean@oss.cyber.gouv.fr/
v2: https://lore.kernel.org/all/20261103225842.3204446-2-Jeremy.Jean@oss.cyber.gouv.fr/
v3: https://lore.kernel.org/all/20261106202910.723098-2-Jeremy.Jean@oss.cyber.gouv.fr/

Jérémy Jean (2):
  xfrm: fix IPv6 first-fragment protocol decode
  xfrm: fix selector matching for IPv6 atomic fragments

 include/net/ipv6.h      |  1 +
 net/ipv6/exthdrs_core.c | 25 ++++++++++----------
 net/xfrm/xfrm_policy.c  | 51 ++++++++++++++++++++++++++++++-----------
 3 files changed, 51 insertions(+), 26 deletions(-)

-- 
2.47.3

[PATCH net v4 1/2] xfrm: fix IPv6 first-fragment protocol decode

[Jérémy Jean]

Commit 7a0207094f1b ("xfrm: policy: replace session decode with flow
dissector") replaced XFRM session decoding with the flow dissector.
While the old IPv6 decoder kept walking past an IPv6 Fragment
extension header, the flow dissector stops unless the caller sets
FLOW_DISSECTOR_F_PARSE_1ST_FRAG. For an atomic fragment followed by
extension headers, inbound policy lookup can therefore see the header
after Fragment instead of the actual upper-layer protocol and miss
protocol selectors.

Make the dissector continue through first IPv6 fragments. Keep the
port, ICMPv6 and GRE selector fields zero for all fragments, as the
old decoder did. This also keeps the result the same when a BPF flow
dissector fills ports for a first fragment.

Fixes: 7a0207094f1b ("xfrm: policy: replace session decode with flow dissector")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 net/xfrm/xfrm_policy.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9ea60c7717ff8..bda5100c9fdbf 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3480,23 +3480,29 @@ decode_session6(const struct xfrm_flow_keys *flkeys, struct flowi *fl, bool reve
 	if (reverse) {
 		fl6->saddr = flkeys->addrs.ipv6.dst;
 		fl6->daddr = flkeys->addrs.ipv6.src;
-		fl6->fl6_sport = flkeys->ports.dst;
-		fl6->fl6_dport = flkeys->ports.src;
 	} else {
 		fl6->saddr = flkeys->addrs.ipv6.src;
 		fl6->daddr = flkeys->addrs.ipv6.dst;
-		fl6->fl6_sport = flkeys->ports.src;
-		fl6->fl6_dport = flkeys->ports.dst;
 	}
 
-	switch (flkeys->basic.ip_proto) {
-	case IPPROTO_GRE:
-		fl6->fl6_gre_key = flkeys->gre.keyid;
-		break;
-	case IPPROTO_ICMPV6:
-		fl6->fl6_icmp_type = flkeys->icmp.type;
-		fl6->fl6_icmp_code = flkeys->icmp.code;
-		break;
+	if (!(flkeys->control.flags & FLOW_DIS_IS_FRAGMENT)) {
+		if (reverse) {
+			fl6->fl6_sport = flkeys->ports.dst;
+			fl6->fl6_dport = flkeys->ports.src;
+		} else {
+			fl6->fl6_sport = flkeys->ports.src;
+			fl6->fl6_dport = flkeys->ports.dst;
+		}
+
+		switch (flkeys->basic.ip_proto) {
+		case IPPROTO_GRE:
+			fl6->fl6_gre_key = flkeys->gre.keyid;
+			break;
+		case IPPROTO_ICMPV6:
+			fl6->fl6_icmp_type = flkeys->icmp.type;
+			fl6->fl6_icmp_code = flkeys->icmp.code;
+			break;
+		}
 	}
 
 	fl6->flowi6_proto = flkeys->basic.ip_proto;
@@ -3507,10 +3513,13 @@ int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl
 			  unsigned int family, int reverse)
 {
 	struct xfrm_flow_keys flkeys;
+	unsigned int flags = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
 
 	memset(&flkeys, 0, sizeof(flkeys));
+	if (family == AF_INET6)
+		flags |= FLOW_DISSECTOR_F_PARSE_1ST_FRAG;
 	__skb_flow_dissect(net, skb, &xfrm_session_dissector, &flkeys,
-			   NULL, 0, 0, 0, FLOW_DISSECTOR_F_STOP_AT_ENCAP);
+			   NULL, 0, 0, 0, flags);
 
 	switch (family) {
 	case AF_INET:
-- 
2.47.3

[PATCH net v4 2/2] xfrm: fix selector matching for IPv6 atomic fragments

[Jérémy Jean]

Commit 7e3a42a12c4b ("xfrm6: handling fragment") stopped decoding IPv6
selector fields after a Fragment header. That is correct for real
fragments because later fragments do not carry those fields, yet an
atomic fragment contains the complete datagram. Leaving its ports,
ICMPv6 type and code, and GRE key zero lets a plaintext packet miss a
policy that matches on one of them.

Leave these fields unset for real fragments. For atomic fragments,
recover the ports at the transport offset found by the flow dissector
and use the decoded ICMPv6 and GRE fields. Have ipv6_find_hdr()
report non-atomic Fragment headers and restore selectors only when
every Fragment header in the chain is atomic.

Read the initial IPv6 header with skb_header_pointer() so nonlinear
headers and headers before skb->data can be inspected without pulling
data or reallocating the skb head. Callers of the policy check can
keep header pointers across session decoding.

Fixes: 7e3a42a12c4b ("xfrm6: handling fragment")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 include/net/ipv6.h      |  1 +
 net/ipv6/exthdrs_core.c | 25 +++++++++++++------------
 net/xfrm/xfrm_policy.c  | 16 +++++++++++++++-
 3 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 3de07e738538f..10785721b013d 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1110,6 +1110,7 @@ enum {
 	IP6_FH_F_FRAG		= (1 << 0),
 	IP6_FH_F_AUTH		= (1 << 1),
 	IP6_FH_F_SKIP_RH	= (1 << 2),
+	IP6_FH_F_NON_ATOMIC	= (1 << 3),
 };
 
 /* find specified header and get offset to it */
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 4a9748338cf40..f00c28ce2f1e7 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -183,7 +183,8 @@ EXPORT_SYMBOL_GPL(ipv6_find_tlv);
  * isn't NULL.
  *
  * if flags is not NULL and it's a fragment, then the frag flag
- * IP6_FH_F_FRAG will be set. If it's an AH header, the
+ * IP6_FH_F_FRAG will be set. IP6_FH_F_NON_ATOMIC will be set for a
+ * non-atomic Fragment header. If it's an AH header, the
  * IP6_FH_F_AUTH flag is set and target < 0, then this function will
  * stop at the AH header. If IP6_FH_F_SKIP_RH flag was passed, then this
  * function will skip all those routing headers, where segements_left was 0.
@@ -191,23 +192,20 @@ EXPORT_SYMBOL_GPL(ipv6_find_tlv);
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 		  int target, unsigned short *fragoff, int *flags)
 {
-	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
-	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+	unsigned int start = *offset ?: skb_network_offset(skb);
+	struct ipv6hdr _ip6, *ip6;
 	int exthdr_cnt = 0;
+	u8 nexthdr;
 	bool found;
 
 	if (fragoff)
 		*fragoff = 0;
 
-	if (*offset) {
-		struct ipv6hdr _ip6, *ip6;
-
-		ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
-		if (!ip6 || (ip6->version != 6))
-			return -EBADMSG;
-		start = *offset + sizeof(struct ipv6hdr);
-		nexthdr = ip6->nexthdr;
-	}
+	ip6 = skb_header_pointer(skb, start, sizeof(_ip6), &_ip6);
+	if (!ip6 || (*offset && ip6->version != 6))
+		return -EBADMSG;
+	nexthdr = ip6->nexthdr;
+	start += sizeof(struct ipv6hdr);
 
 	do {
 		struct ipv6_opt_hdr _hdr, *hp;
@@ -254,6 +252,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 			if (!fp)
 				return -EBADMSG;
 
+			if (flags && (*fp & htons(IP6_OFFSET | IP6_MF)))
+				*flags |= IP6_FH_F_NON_ATOMIC;
+
 			_frag_off = ntohs(*fp) & ~0x7;
 			if (_frag_off) {
 				if (target < 0 &&
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index bda5100c9fdbf..bf2c04180b98c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3526,9 +3526,23 @@ int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl
 		decode_session4(&flkeys, fl, reverse);
 		break;
 #if IS_ENABLED(CONFIG_IPV6)
-	case AF_INET6:
+	case AF_INET6: {
+		unsigned int offset = 0;
+		int fh_flags = 0;
+
+		if ((flkeys.control.flags & FLOW_DIS_IS_FRAGMENT) &&
+		    ipv6_find_hdr(skb, &offset, -1, NULL, &fh_flags) >= 0 &&
+		    (fh_flags & IP6_FH_F_FRAG) &&
+		    !(fh_flags & IP6_FH_F_NON_ATOMIC)) {
+			flkeys.control.flags &= ~FLOW_DIS_IS_FRAGMENT;
+			flkeys.ports.ports = skb_flow_get_ports(skb,
+								flkeys.control.thoff,
+								flkeys.basic.ip_proto,
+								NULL, 0);
+		}
 		decode_session6(&flkeys, fl, reverse);
 		break;
+	}
 #endif
 	default:
 		return -EAFNOSUPPORT;
-- 
2.47.3

Re: [PATCH net v4 2/2] xfrm: fix selector matching for IPv6 atomic fragments

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.

Critical: 0 · High: 1 · Medium: 0 · Low: 1

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] The fix still leaves SCTP over IPv6 atomic fragments with zero
  ports in the XFRM flow, so the policy bypass the commit claims to…
- [Low] The new AF_INET6 branch in __xfrm_decode_session() takes
  FLOW_DIS_IS_FRAGMENT as proof that the dissector parsed an IPv6…

--

xfrm: fix selector matching for IPv6 atomic fragments

This patch restores IPv6 selector fields (ports, ICMPv6 type/code, GRE
key) in __xfrm_decode_session() when every Fragment header in the chain is
atomic. ipv6_find_hdr() gains an IP6_FH_F_NON_ATOMIC flag and now reads the
initial IPv6 header through skb_header_pointer(). The ports are taken
from the transport offset found by the flow dissector.

> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index 4f6a5b81e3b5a..9ea816a8c5f63 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -3530,9 +3530,23 @@ int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl
>  		decode_session4(&flkeys, fl, reverse);
>  		break;
>  #if IS_ENABLED(CONFIG_IPV6)
> -	case AF_INET6:
> +	case AF_INET6: {
> +		unsigned int offset = 0;
> +		int fh_flags = 0;
> +
> +		if ((flkeys.control.flags & FLOW_DIS_IS_FRAGMENT) &&
> +		    ipv6_find_hdr(skb, &offset, -1, NULL, &fh_flags) >= 0 &&

[Severity: Low]

Can FLOW_DIS_IS_FRAGMENT be set here for a packet that isn't IPv6? The
IPv4 branch of __skb_flow_dissect() sets the same flag:

    key_control->flags |= FLOW_DIS_IS_FRAGMENT;

With *offset == 0, the new ipv6_find_hdr() code also skips the version
check:

    if (!ip6 || (*offset && ip6->version != 6))
        return -EBADMSG;

vti6_rcv_cb(), vti_rcv_cb() and xfrmi_rcv_cb() pass
family = x->inner_mode.family. xfrm_inner_mode_encap_remove() picks the
decap routine from the inner nexthdr instead. An IPIP inner packet goes
through xfrm4_remove_tunnel_encap(), which sets
skb->protocol = ETH_P_IP, and the packet is then checked with AF_INET6.

In that case ipv6_find_hdr() parses the IPv4 header as IPv6. Byte 6 is
the IPv4 flags/fragment offset byte, and 0x2C there reads as
NEXTHDR_FRAGMENT. The parser then walks the IPv4 fragment payload as
extension headers.

If those payload bytes look like an atomic Fragment header, this branch
clears FLOW_DIS_IS_FRAGMENT and loads ports from the fragment payload.
Before this patch those ports were always zero.

The addresses are already mis-decoded in this case, and the reassembled
packet gets checked again with AF_INET, so the impact looks small. Should
this branch also check flkeys.basic.n_proto == htons(ETH_P_IPV6) before
it calls ipv6_find_hdr()?

> +		    (fh_flags & IP6_FH_F_FRAG) &&
> +		    !(fh_flags & IP6_FH_F_NON_ATOMIC)) {
> +			flkeys.control.flags &= ~FLOW_DIS_IS_FRAGMENT;
> +			flkeys.ports.ports = skb_flow_get_ports(skb,
> +								flkeys.control.thoff,
> +								flkeys.basic.ip_proto,
> +								NULL, 0);

[Severity: High]

For SCTP over IPv6 atomic fragments, do the ports still end up as zero?

sctp_rcv() pulls skb->data past the SCTP common header before it calls
the policy check:

net/sctp/input.c:sctp_rcv() {
    ...
    __skb_pull(skb, sizeof(struct sctphdr));
    ...
    if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
    ...
}

When __xfrm_decode_session() runs, the transport header therefore sits
before skb->data. The dissector finishes with nhoff = -12. On the
fragment path __skb_flow_dissect() clamps that value:

    thoff = min_t(u32, nhoff, skb ? skb->len : hlen);

Converted to u32, the negative nhoff becomes a very large number, so
thoff becomes skb->len. skb_flow_get_ports() at that offset fails and
returns 0. FLOW_DIS_IS_FRAGMENT has already been cleared at that point,
so decode_session6() copies sport = dport = 0 into the flowi6. The
non-fragment port path uses the signed nhoff and does not have this
problem.

sctpv6_protocol is INET6_PROTO_NOPOLICY, so this is the only IN policy
check SCTP/IPv6 gets. Could a plaintext IPv6 + atomic Fragment + SCTP
packet still miss a policy such as "proto sctp dport X" that requires
ESP?

The ipv6_find_hdr() call above already handles a start before
skb->data. It leaves the correct transport offset in offset and returns
IPPROTO_SCTP. Could those values be used here instead of
flkeys.control.thoff and flkeys.basic.ip_proto?

> +		}
>  		decode_session6(&flkeys, fl, reverse);
>  		break;
> +	}
>  #endif
>  	default:
>  		return -EAFNOSUPPORT;

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261109213803.1785516-2-Jeremy.Jean%40oss.cyber.gouv.fr

Re: [PATCH net v4 2/2] xfrm: fix selector matching for IPv6 atomic fragments

[Florian Westphal]

Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
> +		if ((flkeys.control.flags & FLOW_DIS_IS_FRAGMENT) &&
> +		    ipv6_find_hdr(skb, &offset, -1, NULL, &fh_flags) >= 0 &&
> +		    (fh_flags & IP6_FH_F_FRAG) &&
> +		    !(fh_flags & IP6_FH_F_NON_ATOMIC)) {

Since you need to send a new version anyway, maybe avoid
double-neg, i.e.: (fh_flags & IP6_FH_F_ATOMIC) ?

Re: [PATCH net v4 2/2] xfrm: fix selector matching for IPv6 atomic fragments

[Jérémy Jean]

On 2026-11-12 14:20, Florian Westphal wrote:
> Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>> +		if ((flkeys.control.flags & FLOW_DIS_IS_FRAGMENT) &&
>> +		    ipv6_find_hdr(skb, &offset, -1, NULL, &fh_flags) >= 0 &&
>> +		    (fh_flags & IP6_FH_F_FRAG) &&
>> +		    !(fh_flags & IP6_FH_F_NON_ATOMIC)) {
> 
> Since you need to send a new version anyway, maybe avoid
> double-neg, i.e.: (fh_flags & IP6_FH_F_ATOMIC) ?

Thanks for the advice, I will consider this for the next iteration.

Jérémy

Re: [PATCH net v4 2/2] xfrm: fix selector matching for IPv6 atomic fragments

[Steffen Klassert]

On Thu, Nov 12, 2026 at 02:33:35PM +0100, Jérémy Jean wrote:
> On 2026-11-12 14:20, Florian Westphal wrote:
> > Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
> > > +		if ((flkeys.control.flags & FLOW_DIS_IS_FRAGMENT) &&
> > > +		    ipv6_find_hdr(skb, &offset, -1, NULL, &fh_flags) >= 0 &&
> > > +		    (fh_flags & IP6_FH_F_FRAG) &&
> > > +		    !(fh_flags & IP6_FH_F_NON_ATOMIC)) {
> > 
> > Since you need to send a new version anyway, maybe avoid
> > double-neg, i.e.: (fh_flags & IP6_FH_F_ATOMIC) ?
> 
> Thanks for the advice, I will consider this for the next iteration.

When resending, please make sure to also Cc the new ipsec mailing list
so that the ipsec patchwork can track it:

ipsec@lists.linux.dev

Thanks!

Re: [PATCH net v4 0/2] xfrm: fix IPv6 atomic fragment policy handling

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.