[PATCH net 0/5] net: avoid truncated transport header offsets

[Eric Dumazet <edumazet@kernel.org>]

skb->transport_header is a 16-bit offset from skb->head, and U16_MAX
is reserved as the "not set" value. skb_set_transport_header() silently
truncates an offset that does not fit.

The first patch addresses the report from Hyunwoo Kim, by applying
the IP6_MAX_EXT_HDRS_CNT limit to ipv6_gro_pull_exthdrs().

The four following patches convert places storing an offset derived
from an IPv6 extension header walk to skb_set_transport_header_careful().
A single chain being bounded to 24576 bytes, these need a large
skb->data - skb->head to overflow, for instance after nested
decapsulations. They are hardening, no reproducer was written.

The same change for nf_ct_frag6_gather() is sent separately to
the netfilter tree.

Eric Dumazet (5):
  ipv6: gro: limit the number of extension headers
  ipv6: mcast: use skb_set_transport_header_careful() in
    ipv6_mc_check_exthdrs()
  net: openvswitch: use skb_set_transport_header_careful() in
    parse_ipv6hdr()
  sctp: use skb_set_transport_header_careful() in sctp_v6_err()
  udp: use skb_set_transport_header_careful() in __udp6_lib_err_encap()

 net/ipv6/ip6_offload.c | 8 ++++++++
 net/ipv6/mcast_snoop.c | 3 ++-
 net/ipv6/udp.c         | 7 ++++---
 net/openvswitch/flow.c | 3 ++-
 net/sctp/ipv6.c        | 5 ++++-
 5 files changed, 20 insertions(+), 6 deletions(-)

-- 
2.53.0