[PATCH net 5/5] udp: use skb_set_transport_header_careful() in __udp6_lib_err_encap()

[Eric Dumazet <edumazet@kernel.org>]

skb->transport_header is a 16-bit offset from skb->head, and U16_MAX is
reserved as the "not set" value. skb_set_transport_header() silently
truncates an offset that does not fit.

__udp6_lib_err_encap() stores @offset, computed by icmpv6_notify() from
the extension headers of the packet embedded in an ICMPv6 error. Should
the value be truncated, the tunnel encap_err_lookup() and err_handler()
callbacks would read the UDP header at the wrong place.

Since commit 3744b0964d52 ("ipv6: Implement limits on extension header
parsing") a single chain is bounded to IP6_MAX_EXT_HDRS_CNT headers
(24576 bytes), so this needs a large skb->data - skb->head on top of it,
for instance after several nested decapsulations, each of them possibly
pulling its own extension header chain, since @offset is relative to
the IPv6 header embedded in the ICMPv6 error. No reproducer was written,
this is hardening.

Use skb_set_transport_header_careful() and return an error if the
offset can not be stored, in which case udpv6_err() ignores the
ICMPv6 error. Do this before changing the network header, so that
nothing has to be restored on failure.

Fixes: a36e185e8c85 ("udp: Handle ICMP errors for tunnels with same destination port on both endpoints")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 net/ipv6/udp.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9dcefa162522..a6886a0432f9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -651,12 +651,13 @@ static struct sock *__udp6_lib_err_encap(struct net *net,
 	network_offset = skb_network_offset(skb);
 	transport_offset = skb_transport_offset(skb);
 
+	/* Transport header needs to point to the UDP header */
+	if (unlikely(!skb_set_transport_header_careful(skb, offset)))
+		return ERR_PTR(-EINVAL);
+
 	/* Network header needs to point to the outer IPv6 header inside ICMP */
 	skb_reset_network_header(skb);
 
-	/* Transport header needs to point to the UDP header */
-	skb_set_transport_header(skb, offset);
-
 	if (sk) {
 		up = udp_sk(sk);
 
-- 
2.53.0