[PATCH net] ip6_tunnel: validate ipv4 header in ip4ip6_err()

[Eric Dumazet <edumazet@google.com>]

Oskar Kjos reported the following problem.

ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
value. __ip_options_echo() then reads optlen from attacker-controlled
packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).

To fix this we could simply clear skb2->cb[].

In this patch I chose to validate the inner IPv4 header and
recompute options if any were included.

Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.")
Reported-by: Oskar Kjos <oskar.kjos@hotmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv6/ip6_tunnel.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4c29aa94e86eb9439458e4b23426bfda8b3b8922..1901348617f0a4f48358c1c8135068f4b861059f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -561,6 +561,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	   u8 type, u8 code, int offset, __be32 info)
 {
 	__u32 rel_info = ntohl(info);
+	struct inet_skb_parm parm;
 	const struct iphdr *eiph;
 	struct sk_buff *skb2;
 	int err, rel_msg = 0;
@@ -606,6 +607,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	skb_pull(skb2, offset);
 	skb_reset_network_header(skb2);
 	eiph = ip_hdr(skb2);
+	if (eiph->version != 4 || eiph->ihl < 5)
+		goto out;
 
 	/* Try to guess incoming interface */
 	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
@@ -617,6 +620,18 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	skb2->dev = rt->dst.dev;
 	ip_rt_put(rt);
 
+	memset(&parm, 0, sizeof(parm));
+	if (eiph->ihl > 5) {
+		if (!pskb_network_may_pull(skb2, eiph->ihl * 4))
+			goto out;
+		eiph = ip_hdr(skb2);
+		parm.opt.optlen = eiph->ihl * 4 - sizeof(struct iphdr);
+
+		err = __ip_options_compile(dev_net(skb->dev), &parm.opt, skb2, NULL);
+
+		if (err)
+			goto out;
+	}
 	/* route "incoming" packet */
 	if (rt->rt_flags & RTCF_LOCAL) {
 		rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
@@ -644,7 +659,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		skb_dst_update_pmtu_no_confirm(skb2, rel_info);
 	}
 
-	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
+	__icmp_send(skb2, rel_type, rel_code, htonl(rel_info), &parm);
 
 out:
 	kfree_skb(skb2);
-- 
2.53.0.1018.g2bb0e51243-goog