[PATCH net v2] netfilter: nf_conntrack_reasm: avoid truncating header offsets

[sung byeongchan <tjdqudcks0424@naver.com>]

From: 성병찬 <tjdqudcks0424@naver.com>

find_prev_fhdr() stores the offset of the previous Next Header field in
an 8-bit variable. A valid IPv6 extension header chain can place that
field at offset 256, causing the value to wrap to zero. Reassembly then
writes the Fragment Header's next-header value to the wrong byte.

Use int for prev_nhoff so the offset is preserved until it is checked by
its consumer.

The same path also passes an unchecked offset to two 16-bit consumers:
frag_queue.nhoffset and skb->transport_header. On the LOCAL_OUT raw path,
a 65536-byte IPv6 packet can place the Fragment Header at offset 65528.
With 16 bytes of skb headroom, skb_set_transport_header() truncates 65544
to 8. In the reproduced path, reassembly subsequently passes -8 as the
unsigned skb_push() length and triggers skb_under_panic().

Reject a previous-header offset that cannot be represented by nhoffset,
and use skb_set_transport_header_careful() to reject a Fragment Header
offset that cannot be represented relative to skb->head.

The prev_nhoff widening was previously posted by Jérémy Jean. This
revision folds it together with the remaining 16-bit checks, as requested
by Pablo Neira Ayuso.

The 16-bit transport-header failure reproduced on three independent
boots, including one run from outer UID 65534 in new user and network
namespaces. With the combined fix, the trigger was rejected safely in
three runs. Short fragments, ordinary IPv6 TCP and UDP, and the earlier
offset-248 and offset-256 cases continued to work.

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Link: https://lore.kernel.org/netfilter-devel/20260822214012.1028305-2-Jeremy.Jean@oss.cyber.gouv.fr/
Link: https://lore.kernel.org/netfilter-devel/179089937913.434549.5874493628033954656@kernel.org/
Cc: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: 성병찬 <tjdqudcks0424@naver.com>
---
Changes in v2:
- Fold the remaining u16 nhoffset and transport-header checks into the
  prev_nhoff fix, as requested by Pablo Neira Ayuso.
- Add the three-run crash and fixed A/B results.
- Credit Jérémy Jean's earlier posting of the prev_nhoff widening.

 net/ipv6/netfilter/nf_conntrack_reasm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 599c49bf0a0a..ae25ebc873b0 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -398,7 +398,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
 {
 	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 	const int netoff = skb_network_offset(skb);
-	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
+	int prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
 	int start = netoff + sizeof(struct ipv6hdr);
 	int len = skb->len - start;
 	u8 prevhdr = NEXTHDR_IPV6;
@@ -474,7 +474,9 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
 	if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
 		return -ENOMEM;
 
-	skb_set_transport_header(skb, fhoff);
+	if (nhoff != (u16)nhoff ||
+	    !skb_set_transport_header_careful(skb, fhoff))
+		return -EINVAL;
 	hdr = ipv6_hdr(skb);
 	fhdr = (struct frag_hdr *)skb_transport_header(skb);
 
base-commit: 6d25ffca055a77787c21a36b66c253f76239411b
-- 
2.43.0