Re: [PATCH net v3] ipv6: Implement limits on extension header parsing

[Daniel Borkmann <daniel@iogearbox.net>]

On 4/27/26 3:14 PM, David Laight wrote:
> On Mon, 27 Apr 2026 12:13:18 +0200
> Daniel Borkmann <daniel@iogearbox.net> wrote:
[...]
>> ---
>>   v2->v3:
>>     - Adding IP6SKB_HOPBYHOP coverage (Justin)
>>     - I left the limit at 8 w/ sysctl, still feels the better
>>       option to me if we can keep the worst-case more tightened
>>   v1->v2:
>>     - Set the default to 8 (Justin)
>>     - Update IETF references (Justin)
>>     - Add core path coverage as well (Justin)
> ...
>> @@ -72,7 +74,9 @@ EXPORT_SYMBOL(ipv6_ext_hdr);
>>   int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
>>   		     __be16 *frag_offp)
>>   {
>> +	int exthdr_max = READ_ONCE(init_net.ipv6.sysctl.max_ext_hdrs_cnt);
>>   	u8 nexthdr = *nexthdrp;
>> +	int exthdr_cnt = 0;
>>   
>>   	*frag_offp = 0;
>>   
>> @@ -82,6 +86,8 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
>>   
>>   		if (nexthdr == NEXTHDR_NONE)
>>   			return -1;
>> +		if (unlikely(exthdr_cnt++ >= exthdr_max))
>> +			return -1;
> 
> It would be better to decrement the count and error at zero.
> 		if (unlikely(--exthdr_max < 0))
> 			return -1;
Well, its in the same style as the other existing gating counters, I'd
rather leave as-is rather than mixing inc/decs.

Thanks,
Daniel