Re: [PATCH net v3] xfrm: interface: validate the IP header on xmit

[Herbert Xu <herbert@gondor.apana.org.au>]

On Wed, Sep 23, 2026 at 11:24:56AM +0800, Qihang wrote:
>
> diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
> index 688306b..5cc906a 100644
> --- a/net/xfrm/xfrm_interface_core.c
> +++ b/net/xfrm/xfrm_interface_core.c
> @@ -531,6 +531,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
>  
>  	memset(&fl, 0, sizeof(fl));
>  
> +	if (!pskb_inet_may_pull(skb))
> +		goto tx_err;
> +
>  	switch (skb->protocol) {
>  	case htons(ETH_P_IPV6):
>  		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
> @@ -548,6 +551,9 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
>  		}
>  		break;
>  	case htons(ETH_P_IP):
> +		if (ip_hdr(skb)->ihl < 5 ||
> +		    !pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
> +			goto tx_err;

Thank you for the quick fix!

I haven't looked at this deeply but should we verify the IPv6 case
as well?

Also we should try to do the same verification that a packet would
normally get upon entry into the IP stack.  So that means checking
iph->version as well.  The standard entry point is ip_rcv_core and
the same checks should apply whether you went through there or one
of these non-standard entry points.

Perhaps we should abstract out the verifications from ip_rcv_core
so that it can be done by all these entry points in a uniform way.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt