Re: [PATCH nf 0/1] netfilter: nf_ip6_checksum: validate checksum offset

[Florian Westphal <fw@strlen.de>]

Zixuan Chai <petalzu987@gmail.com> wrote:
> On Fri, 18 Sept 2026 at 22:15, Florian Westphal <fw@strlen.de> wrote:
> >
> > Florian Westphal <fw@strlen.de> wrote:
> > > > We will provide detailed information about the bug in this email,
> > > > along with a PoC to trigger it.
> > >
> > > patch is fine, but could you make another patch that either fixes
> > > ipv6_find_hdr() or ip6_packet_match() / nft_set_pktinfo_ipv6() as well?

FTR, ipv6_find_hdr() gained this check in
ee319bd3a0e9 ("ipv6: do not let ipv6_find_hdr() return an offset past the packet end")

> > To clarify, I agree with this patch, I don't mean that the other
> > patch should replace this one. I see them as separate issues, so:
> 
> When you have a moment, could you please let me know if any further
> changes would be helpful for this patch? I would be happy to send a
> revised version if needed.

netfilter patchwork is clogged up/backlogged, unfortunately.

> > ipv6_skip_exthdr() may have the same issue.
> 
> I have also been looking into the ipv6_skip_exthdr() issue you
> mentioned. I think it needs further evaluation, but so far I have
> not been able to construct a PoC similar to the one for the
> checksum issue.

> One attempt is this series:
> https://lore.kernel.org/all/cover.1790082243.git.petalzu987@gmail.com/
> 
> I am not sure whether this issue warrants a fix, so I would
> appreciate your thoughts on whether it is worth pursuing.

Wrt 2/2 Eric is right, I never reported an issue with i40e.
The ipv6_skip_exthdr() change in patch 1/2 looks good to me.

The other changes in 1/2 should probably be in a different patch;
I feel its doing too many different things at the same time.