Re: [PATCH nf 0/1] netfilter: nf_ip6_checksum: validate checksum offset

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Thu, Oct 08, 2026 at 07:24:59PM +0200, Florian Westphal wrote:
> > Zixuan Chai <petalzu987@gmail.com> wrote:
> > > On Fri, 18 Sept 2026 at 22:15, Florian Westphal <fw@strlen.de> wrote:
> > > >
> > > > Florian Westphal <fw@strlen.de> wrote:
> > > > > > We will provide detailed information about the bug in this email,
> > > > > > along with a PoC to trigger it.
> > > > >
> > > > > patch is fine, but could you make another patch that either fixes
> > > > > ipv6_find_hdr() or ip6_packet_match() / nft_set_pktinfo_ipv6() as well?
> > 
> > FTR, ipv6_find_hdr() gained this check in
> > ee319bd3a0e9 ("ipv6: do not let ipv6_find_hdr() return an offset past the packet end")
> 
> Then this is fixed upstream in the core, now it validates that the
> offset provides enough room for the announced header.
> 
> This patch is now hardening that can follow up to nf-next using 
> DEBUG_NET_WARN_ON_ONCE?

Yes, I think this should get a v2, targetting nf-next.  It would also be
good to be consistent here: We have multiple interfaces:
nf_ip6_checksum, nf_checksum_partial, nf_ip6_checksum_partialm, nf_ip_checksum, ...

So I think there should be consistency there too, either none should
have checks or all of them should have DEBUG_NET_WARN_ON_ONCE() +
return where applicable.