* [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()
@ 2025-07-30 13:17 Eric Dumazet
2025-07-30 14:47 ` Dawid Osuchowski
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Eric Dumazet @ 2025-07-30 13:17 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Willem de Bruijn, David Ahern, netdev, eric.dumazet,
Eric Dumazet, syzbot+af43e647fd835acc02df
syzbot was able to craft a packet with very long IPv6 extension headers
leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skb_reset_transport_header_careful() helper and use it
from ipv6_gso_segment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Modules linked in:
CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Call Trace:
<TASK>
skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
__skb_gso_segment+0x342/0x510 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
__dev_xmit_skb net/core/dev.c:4102 [inline]
__dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support")
Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
include/linux/skbuff.h | 23 +++++++++++++++++++++++
net/ipv6/ip6_offload.c | 4 +++-
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b8b06e71b73ea3fb5210239f585f4ba714395fd7..14b923ddb6dfcc3c031a7c9e4cb5fc4171424616 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3033,6 +3033,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb)
skb->transport_header = offset;
}
+/**
+ * skb_reset_transport_header_careful - conditionally reset transport header
+ * @skb: buffer to alter
+ *
+ * Hardened version of skb_reset_transport_header().
+ *
+ * Returns: true if the operation was a success.
+ */
+static inline bool __must_check
+skb_reset_transport_header_careful(struct sk_buff *skb)
+{
+ long offset = skb->data - skb->head;
+
+ if (unlikely(offset != (typeof(skb->transport_header))offset))
+ return false;
+
+ if (unlikely(offset == (typeof(skb->transport_header))~0U))
+ return false;
+
+ skb->transport_header = offset;
+ return true;
+}
+
static inline void skb_set_transport_header(struct sk_buff *skb,
const int offset)
{
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 9822163428b028d6dbf3f48abe4674bd6c581725..fce91183797a60fcbf271c73e086aeb0aa9d40c6 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -148,7 +148,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
ops = rcu_dereference(inet6_offloads[proto]);
if (likely(ops && ops->callbacks.gso_segment)) {
- skb_reset_transport_header(skb);
+ if (!skb_reset_transport_header_careful(skb))
+ goto out;
+
segs = ops->callbacks.gso_segment(skb, features);
if (!segs)
skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
--
2.50.1.552.g942d659e1b-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()
2025-07-30 13:17 [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment() Eric Dumazet
@ 2025-07-30 14:47 ` Dawid Osuchowski
2025-07-30 16:58 ` Willem de Bruijn
2025-08-02 0:14 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Dawid Osuchowski @ 2025-07-30 14:47 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Willem de Bruijn, David Ahern, netdev, eric.dumazet,
syzbot+af43e647fd835acc02df
On 2025-07-30 3:17 PM, Eric Dumazet wrote:
> syzbot was able to craft a packet with very long IPv6 extension headers
> leading to an overflow of skb->transport_header.
>
> This 16bit field has a limited range.
>
> Add skb_reset_transport_header_careful() helper and use it
> from ipv6_gso_segment()
>
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Modules linked in:
> CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
> RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Call Trace:
> <TASK>
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> __skb_gso_segment+0x342/0x510 net/core/gso.c:124
> skb_gso_segment include/net/gso.h:83 [inline]
> validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
> validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
> sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
> __dev_xmit_skb net/core/dev.c:4102 [inline]
> __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
>
> Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support")
> Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Thanks,
Dawid
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()
2025-07-30 13:17 [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment() Eric Dumazet
2025-07-30 14:47 ` Dawid Osuchowski
@ 2025-07-30 16:58 ` Willem de Bruijn
2025-08-02 0:14 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Willem de Bruijn @ 2025-07-30 16:58 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Willem de Bruijn, David Ahern, netdev, eric.dumazet,
Eric Dumazet, syzbot+af43e647fd835acc02df
Eric Dumazet wrote:
> syzbot was able to craft a packet with very long IPv6 extension headers
> leading to an overflow of skb->transport_header.
>
> This 16bit field has a limited range.
>
> Add skb_reset_transport_header_careful() helper and use it
> from ipv6_gso_segment()
>
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Modules linked in:
> CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
> RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Call Trace:
> <TASK>
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
> __skb_gso_segment+0x342/0x510 net/core/gso.c:124
> skb_gso_segment include/net/gso.h:83 [inline]
> validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
> validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
> sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
> __dev_xmit_skb net/core/dev.c:4102 [inline]
> __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
>
> Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support")
> Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()
2025-07-30 13:17 [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment() Eric Dumazet
2025-07-30 14:47 ` Dawid Osuchowski
2025-07-30 16:58 ` Willem de Bruijn
@ 2025-08-02 0:14 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-08-02 0:14 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, willemb, dsahern, netdev,
eric.dumazet, syzbot+af43e647fd835acc02df
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 30 Jul 2025 13:17:38 +0000 you wrote:
> syzbot was able to craft a packet with very long IPv6 extension headers
> leading to an overflow of skb->transport_header.
>
> This 16bit field has a limited range.
>
> Add skb_reset_transport_header_careful() helper and use it
> from ipv6_gso_segment()
>
> [...]
Here is the summary with links:
- [net] ipv6: reject malicious packets in ipv6_gso_segment()
https://git.kernel.org/netdev/net/c/d45cf1e7d718
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-02 0:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-30 13:17 [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment() Eric Dumazet
2025-07-30 14:47 ` Dawid Osuchowski
2025-07-30 16:58 ` Willem de Bruijn
2025-08-02 0:14 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).