[PATCH net v3] xfrm: interface: validate the IP header on xmit

[PATCH net v3] xfrm: interface: validate the IP header on xmit

[Qihang]

Packets injected into an xfrm interface (e.g. AF_PACKET on an xfrmi
device) reach the xfrm output path without IP header validation, but
xfrm4_transport_output() uses iph->ihl for __skb_pull() and memmove()
and expects the header to be valid.

vti_tunnel_xmit() already calls pskb_inet_may_pull() before handing
packets to the xfrm output path.  Do the same in xfrmi_xmit() and also
reject malformed IPv4 header lengths.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
---
Changes since v2: validate at the xfrmi_xmit() entry point instead of
inside xfrm4_transport_output().

 net/xfrm/xfrm_interface_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 688306b..5cc906a 100644
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -531,6 +531,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	memset(&fl, 0, sizeof(fl));
 
+	if (!pskb_inet_may_pull(skb))
+		goto tx_err;
+
 	switch (skb->protocol) {
 	case htons(ETH_P_IPV6):
 		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
@@ -548,6 +551,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 		}
 		break;
 	case htons(ETH_P_IP):
+		if (ip_hdr(skb)->ihl < 5 ||
+		    !pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
+			goto tx_err;
 		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 		xfrm_decode_session(dev_net(dev), skb, &fl, AF_INET);
 		if (!dst) {
-- 
2.46.0

Re: [PATCH net v3] xfrm: interface: validate the IP header on xmit

[Herbert Xu]

On Wed, Sep 23, 2026 at 11:24:56AM +0800, Qihang wrote:
>
> diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
> index 688306b..5cc906a 100644
> --- a/net/xfrm/xfrm_interface_core.c
> +++ b/net/xfrm/xfrm_interface_core.c
> @@ -531,6 +531,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
>  
>  	memset(&fl, 0, sizeof(fl));
>  
> +	if (!pskb_inet_may_pull(skb))
> +		goto tx_err;
> +
>  	switch (skb->protocol) {
>  	case htons(ETH_P_IPV6):
>  		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
> @@ -548,6 +551,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
>  		}
>  		break;
>  	case htons(ETH_P_IP):
> +		if (ip_hdr(skb)->ihl < 5 ||
> +		    !pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
> +			goto tx_err;

Thank you for the quick fix!

I haven't looked at this deeply but should we verify the IPv6 case
as well?

Also we should try to do the same verification that a packet would
normally get upon entry into the IP stack.  So that means checking
iph->version as well.  The standard entry point is ip_rcv_core and
the same checks should apply whether you went through there or one
of these non-standard entry points.

Perhaps we should abstract out the verifications from ip_rcv_core
so that it can be done by all these entry points in a uniform way.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt