Re: [PATCH nf 0/1] netfilter: nf_ip6_checksum: validate checksum offset

[Florian Westphal <fw@strlen.de>]

Ren Wei <weir@nebusec.ai> wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> Hi Linux kernel maintainers,
> 
> We found and validated an issue in net/netfilter/utils.c. The bug can be
> reached by a non-root user when unprivileged user namespaces are enabled,
> using user and network namespaces. We tested the fix in QEMU, and it does
> not affect valid checksum handling or other tested functionality.
> 
> We will provide detailed information about the bug in this email,
> along with a PoC to trigger it.

patch is fine, but could you make another patch that either fixes
ipv6_find_hdr() or ip6_packet_match() / nft_set_pktinfo_ipv6() as well?

If I read this right then ipv6_find_hdr() returns nexthdr 'TCP',
but its clear packet is malformed and that header isn't there.

Assuming nexthdr would not pass ipv6_ext_hdr() / nexthdr == NONE
test. then this would hit:

 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
 if (!hp)
      return -EBADMSG;

(as start is past skb->len).

... so I think ipv6_find_hdr() should also validate offset
is not past skb->len before telling the caller that 'nexthdr'
is at offset <bignum>.

Or do you see a case where this would break anything?

Thanks!