* [PATCH] netfilter: guard option walkers against 1-byte tail reads
@ 2026-03-07 18:26 David Dull
2026-03-07 18:34 ` Florian Westphal
2026-03-07 18:45 ` [PATCH v2] " David Dull
0 siblings, 2 replies; 6+ messages in thread
From: David Dull @ 2026-03-07 18:26 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw, David Dull
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.
Cc: fw@strlen.de
Cc: stable@vger.kernel.org
Signed-off-by: David Dull <monderasdor@gmail.com>
---
net/netfilter/xt_dccp.c | 4 ++--
net/netfilter/xt_tcpudp.c | 6 ++++--
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index e5a13ecbe6..037ab93e25 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,
return true;
}
- if (op[i] < 2)
+ if (op[i] < 2 || i == optlen - 1)
i++;
else
- i += op[i+1]?:1;
+ i += op[i + 1] ? : 1;
}
spin_unlock_bh(&dccp_buflock);
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index e8991130a3..f76cf18f1a 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -59,8 +59,10 @@ tcp_find_option(u_int8_t option,
for (i = 0; i < optlen; ) {
if (op[i] == option) return !invert;
- if (op[i] < 2) i++;
- else i += op[i+1]?:1;
+ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i + 1] ? : 1;
}
return invert;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] netfilter: guard option walkers against 1-byte tail reads
2026-03-07 18:26 [PATCH] netfilter: guard option walkers against 1-byte tail reads David Dull
@ 2026-03-07 18:34 ` Florian Westphal
2026-03-07 18:45 ` [PATCH v2] " David Dull
1 sibling, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2026-03-07 18:34 UTC (permalink / raw)
To: David Dull; +Cc: netfilter-devel
David Dull <monderasdor@gmail.com> wrote:
> When the last byte of options is a non-single-byte option kind, walkers
> that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
> of the option area.
>
> Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
> in xt_tcpudp and xt_dccp option walkers.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] netfilter: guard option walkers against 1-byte tail reads
2026-03-07 18:26 [PATCH] netfilter: guard option walkers against 1-byte tail reads David Dull
2026-03-07 18:34 ` Florian Westphal
@ 2026-03-07 18:45 ` David Dull
2026-03-08 11:11 ` Pablo Neira Ayuso
2026-03-08 15:52 ` [PATCH v3] " David Dull
1 sibling, 2 replies; 6+ messages in thread
From: David Dull @ 2026-03-07 18:45 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw, David Dull
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Cc: fw@strlen.de
Cc: stable@vger.kernel.org
Signed-off-by: David Dull <monderasdor@gmail.com>
---
net/netfilter/xt_dccp.c | 4 ++--
net/netfilter/xt_tcpudp.c | 6 ++++--
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index e5a13ecbe6..037ab93e25 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,
return true;
}
- if (op[i] < 2)
+ if (op[i] < 2 || i == optlen - 1)
i++;
else
- i += op[i+1]?:1;
+ i += op[i + 1] ? : 1;
}
spin_unlock_bh(&dccp_buflock);
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index e8991130a3..f76cf18f1a 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -59,8 +59,10 @@ tcp_find_option(u_int8_t option,
for (i = 0; i < optlen; ) {
if (op[i] == option) return !invert;
- if (op[i] < 2) i++;
- else i += op[i+1]?:1;
+ if (op[i] < 2 || i == optlen - 1)
+ i++;
+ else
+ i += op[i + 1] ? : 1;
}
return invert;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] netfilter: guard option walkers against 1-byte tail reads
2026-03-07 18:45 ` [PATCH v2] " David Dull
@ 2026-03-08 11:11 ` Pablo Neira Ayuso
2026-03-08 15:52 ` [PATCH v3] " David Dull
1 sibling, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2026-03-08 11:11 UTC (permalink / raw)
To: David Dull; +Cc: netfilter-devel, fw
On Sat, Mar 07, 2026 at 08:45:52PM +0200, David Dull wrote:
> When the last byte of options is a non-single-byte option kind, walkers
> that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
> of the option area.
>
> Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
> in xt_tcpudp and xt_dccp option walkers.
>
> Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
> Cc: fw@strlen.de
> Cc: stable@vger.kernel.org
> Signed-off-by: David Dull <monderasdor@gmail.com>
> ---
> net/netfilter/xt_dccp.c | 4 ++--
> net/netfilter/xt_tcpudp.c | 6 ++++--
> 2 files changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
> index e5a13ecbe6..037ab93e25 100644
> --- a/net/netfilter/xt_dccp.c
> +++ b/net/netfilter/xt_dccp.c
> @@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,
> return true;
> }
>
> - if (op[i] < 2)
> + if (op[i] < 2 || i == optlen - 1)
> i++;
> else
> - i += op[i+1]?:1;
> + i += op[i + 1] ? : 1;
> }
To improve this area, I'd suggest:
if (op[i] < 2) {
i++;
continue;
}
if (i + 1 >= optlen)
break;
i += op[i + 1] ? : 1;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v3] netfilter: guard option walkers against 1-byte tail reads
2026-03-07 18:45 ` [PATCH v2] " David Dull
2026-03-08 11:11 ` Pablo Neira Ayuso
@ 2026-03-08 15:52 ` David Dull
2026-03-08 17:05 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: David Dull @ 2026-03-08 15:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw, David Dull
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Handle single-byte options first, then check that a length byte is still
available before reading op[i + 1] in xt_tcpudp and xt_dccp option
walkers.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Cc: stable@vger.kernel.org
Signed-off-by: David Dull <monderasdor@gmail.com>
---
net/netfilter/xt_dccp.c | 8 ++++++--
net/netfilter/xt_tcpudp.c | 8 ++++++--
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index e5a13ecbe6..7f9e2d5c1b 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -62,10 +62,14 @@ dccp_find_option(u_int8_t option,
return true;
}
- if (op[i] < 2 || i == optlen - 1)
+ if (op[i] < 2) {
i++;
- else
+ continue;
+ }
+
+ if (i + 1 >= optlen)
+ break;
+
i += op[i + 1] ? : 1;
}
spin_unlock_bh(&dccp_buflock);
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index e8991130a3..4f29b1dd0f 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -59,10 +59,14 @@ tcp_find_option(u_int8_t option,
for (i = 0; i < optlen; ) {
if (op[i] == option) return !invert;
- if (op[i] < 2 || i == optlen - 1)
+ if (op[i] < 2) {
i++;
- else
+ continue;
+ }
+
+ if (i + 1 >= optlen)
+ break;
+
i += op[i + 1] ? : 1;
}
return invert;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v3] netfilter: guard option walkers against 1-byte tail reads
2026-03-08 15:52 ` [PATCH v3] " David Dull
@ 2026-03-08 17:05 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2026-03-08 17:05 UTC (permalink / raw)
To: David Dull; +Cc: netfilter-devel, fw
On Sun, Mar 08, 2026 at 05:52:11PM +0200, David Dull wrote:
> When the last byte of options is a non-single-byte option kind, walkers
> that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
> of the option area.
>
> Handle single-byte options first, then check that a length byte is still
> available before reading op[i + 1] in xt_tcpudp and xt_dccp option
> walkers.
>
> Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Dull <monderasdor@gmail.com>
> ---
> net/netfilter/xt_dccp.c | 8 ++++++--
> net/netfilter/xt_tcpudp.c | 8 ++++++--
> 2 files changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
> index e5a13ecbe6..7f9e2d5c1b 100644
> --- a/net/netfilter/xt_dccp.c
> +++ b/net/netfilter/xt_dccp.c
> @@ -62,10 +62,14 @@ dccp_find_option(u_int8_t option,
> return true;
> }
>
> - if (op[i] < 2 || i == optlen - 1)
> + if (op[i] < 2) {
> i++;
> - else
> + continue;
> + }
> +
> + if (i + 1 >= optlen)
> + break;
> +
> i += op[i + 1] ? : 1;
This indent is wrong, I posted this patch:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260308112510.2958551-1-pablo@netfilter.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-03-08 17:05 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-07 18:26 [PATCH] netfilter: guard option walkers against 1-byte tail reads David Dull
2026-03-07 18:34 ` Florian Westphal
2026-03-07 18:45 ` [PATCH v2] " David Dull
2026-03-08 11:11 ` Pablo Neira Ayuso
2026-03-08 15:52 ` [PATCH v3] " David Dull
2026-03-08 17:05 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox