Re: [PATCH nf 0/1] netfilter: nf_ip6_checksum: validate checksum offset

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Sep 18, 2026 at 12:38:28PM +0200, Florian Westphal wrote:
> Ren Wei <weir@nebusec.ai> wrote:
> > From: Zixuan Chai <petalzu987@gmail.com>
> > 
> > Hi Linux kernel maintainers,
> > 
> > We found and validated an issue in net/netfilter/utils.c. The bug can be
> > reached by a non-root user when unprivileged user namespaces are enabled,
> > using user and network namespaces. We tested the fix in QEMU, and it does
> > not affect valid checksum handling or other tested functionality.
> > 
> > We will provide detailed information about the bug in this email,
> > along with a PoC to trigger it.
> 
> patch is fine, but could you make another patch that either fixes
> ipv6_find_hdr() or ip6_packet_match() / nft_set_pktinfo_ipv6() as well?
> 
> If I read this right then ipv6_find_hdr() returns nexthdr 'TCP',
> but its clear packet is malformed and that header isn't there.
> 
> Assuming nexthdr would not pass ipv6_ext_hdr() / nexthdr == NONE
> test. then this would hit:
> 
>  hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
>  if (!hp)
>       return -EBADMSG;
> 
> (as start is past skb->len).
> 
> ... so I think ipv6_find_hdr() should also validate offset
> is not past skb->len before telling the caller that 'nexthdr'
> is at offset <bignum>.

+1 for fixing this from ipv6_find_hdr() if it is feasible.

> Or do you see a case where this would break anything?
> 
> Thanks!