Re: [PATCH] ipv6: check if dereference of ipv6 header is safe

[Hannes Frederic Sowa <hannes@stressinduktion.org>]

On Thu, Jan 17, 2013 at 06:21:37PM -0800, Eric Dumazet wrote:
> But we use a 'struct iphdr' here, not a ipv6hdr
> 
> So we basically implicitely rely on sizeof(struct iphdr) <=
> sizeof(struct ipv6hdr)
> 
> I would leave the pskb_may_pull() call and fix it, even if not really
> needed.

Please correct me if I am wrong:

The callstack as captured in ipip6_rcv:
    ipip6_rcv+0xcd/0x680 [sit]
    tunnel64_rcv+0x4a/0x174 [tunnel4]
    ip_local_deliver+0x152/0x470
    ? ip_local_deliver+0x75/0x470
    ip_rcv+0x36d/0x650

ip_rcv does first check if the ipv4 header is complete (inclusive options) and
passes control to ip_local_deliver which calls __skb_pull(skb,
ip_hdrlen(skb)). So ->data is forwarded behind the ipv4 header. The next
pskb_may_pull check would check if the necessary amount of data behind the
ipv4 header is available hence I assume the check in tunnel64_rcv is enough:

    109 static int tunnel64_rcv(struct sk_buff *skb)
    110 {
    111         struct xfrm_tunnel *handler;
    112 
    113         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
    114                 goto drop;
    115 
    116         for_each_tunnel_rcu(tunnel64_handlers, handler)
    117                 if (!handler->handler(skb))
    118                         return 0;

Thanks,

  Hannes