From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Eric Dumazet <edumazet@google.com>,
"David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>,
Willem de Bruijn <willemb@google.com>,
David Ahern <dsahern@kernel.org>,
netdev@vger.kernel.org, eric.dumazet@gmail.com,
Eric Dumazet <edumazet@google.com>,
syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
Subject: Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()
Date: Wed, 30 Jul 2025 12:58:39 -0400 [thread overview]
Message-ID: <688a4f3f7d969_1d29db294cf@willemb.c.googlers.com.notmuch> (raw)
In-Reply-To: <20250730131738.3385939-1-edumazet@google.com>
Eric Dumazet wrote:
> syzbot was able to craft a packet with very long IPv6 extension headers
> leading to an overflow of skb->transport_header.
>
> This 16bit field has a limited range.
>
> Add skb_reset_transport_header_careful() helper and use it
> from ipv6_gso_segment()
>
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Modules linked in:
> CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
> RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Call Trace:
> <TASK>
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> __skb_gso_segment+0x342/0x510 net/core/gso.c:124
> skb_gso_segment include/net/gso.h:83 [inline]
> validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
> validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
> sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
> __dev_xmit_skb net/core/dev.c:4102 [inline]
> __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
>
> Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support")
> Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
next prev parent reply other threads:[~2025-07-30 16:58 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-30 13:17 [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment() Eric Dumazet
2025-07-30 14:47 ` Dawid Osuchowski
2025-07-30 16:58 ` Willem de Bruijn [this message]
2025-08-02 0:14 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=688a4f3f7d969_1d29db294cf@willemb.c.googlers.com.notmuch \
--to=willemdebruijn.kernel@gmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox