Re: [PATCH net] ipv6: Check the Home Address option again before its address is used

[Ido Schimmel <idosch@nvidia.com>]

On Mon, Nov 02, 2026 at 06:49:22AM +0000, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> ipv6_dest_hao() checks the Home Address option and sets IP6CB(skb)->dsthao
> to the offset of the destination options header. Later mip6_addr_swap() and
> mip6_destopt_reject() call ipv6_find_tlv() with that offset and use the 16
> address bytes. They assume that the same header is still there.
> 
> But the seg6 and ioam6 lwtunnels, the End.B6 actions, ipv6_rpl_srh_rcv()
> and BPF lwt progs move or rewrite the IPv6 headers and keep IP6CB(skb).
> Then ipv6_find_tlv() parses other bytes. It returns when the type matches,
> before it checks that the option is inside the header. Nobody checks the
> length of the option again. Thus mip6_addr_swap() can write after the data
> of the skb. mip6_destopt_reject() can copy that memory to an xfrm report.
> 
> In ipv6_find_tlv(), check the length of an option before its type. The
> returned option is then inside the header, and the header is inside the
> linear data. In both callers, ignore an option with a length other than 16,
> as if ipv6_find_tlv() found none. Then the ICMPv6 error goes to the source
> address of the IPv6 header, and the xfrm report has no XFRMA_COADDR
> attribute. Nothing changes for a header that ip6_parse_tlv() accepted and
> that is still in its place. For the other callers an incomplete option is
> now absent:
> 
>  - ip6_find_1stfragopt() and mip6_rthdr_offset() can return another offset
>    for the fragment header or the xfrm header, also in a forwarded packet.
>  - calipso_skbuff_optptr() returns NULL. netlbl_skbuff_getattr() and
>    netlbl_cache_add() then see no option. calipso_skbuff_delattr() returns
>    0 and the packet continues unchanged. Today it returns -EINVAL and
>    SELinux drops the packet. It already returns 0 when an earlier option is
>    incomplete. The receiver drops such a header in ip6_parse_tlv().
> 
> The code that moves the headers still does not reset the offset or the
> other fields of IP6CB(skb). If the bytes there look like a header with a
> Home Address option of length 16, both callers still use its address.
> 
> The first tag also covers ipv6_find_tlv(), because its early return did no
> harm before mip6_addr_swap(). The second tag is for mip6_destopt_reject().
> 
> Fixes: 793832361fe7 ("[IPV6] MIP6: Revert address to send ICMPv6 error.")
> Fixes: 70182ed23d25 ("[IPV6] MIP6: Report to user-space when home address option is rejected.")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>