[PATCH net 1/5] ipv6: gro: limit the number of extension headers

[Eric Dumazet <edumazet@kernel.org>]

Hyunwoo Kim reported that a long chain of IPv6 extension headers
can push the transport header offset of a GRO packet beyond what
the 16-bit skb->transport_header can store. The truncated offset
is later used by gro_receive_network_flush() to locate the network
header of a packet held in the GRO list, leading to an out-of-bounds
read.

Since commit 3744b0964d52 ("ipv6: Implement limits on extension header
parsing"), ip6_protocol_deliver_rcu() drops packets carrying more than
IP6_MAX_EXT_HDRS_CNT extension headers, but ipv6_gro_pull_exthdrs()
was left unbounded.

There is no point trying to aggregate packets that the stack is going
to drop anyway if they are locally delivered. Apply the same limit in
ipv6_gro_pull_exthdrs().

When the limit is hit, @proto still designates an extension header.
Extension header offloads have no gro_receive() callback, so
ipv6_gro_receive() takes its existing "goto out" path with flush set,
and the packet is given to the normal receive path. Local delivery
drops it with SKB_DROP_REASON_IPV6_TOO_MANY_EXTHDRS, while forwarded
packets are simply not aggregated.

An extension header being at most 2048 bytes, this bounds a chain
to 24576 bytes.

Note that offsets can still accumulate over nested encapsulations,
so the places storing them should be hardened separately.

Fixes: 4b0ebbca3e16 ("net: gro: move L3 flush checks to tcp_gro_receive and udp_gro_receive_segment")
Cc: stable@vger.kernel.org
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/netdev/avTTQNyvwPP6LtGx@v4bel/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David Ahern <dsahern@kernel.org>
Cc: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv6/ip6_offload.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 700f1861d8eb..01642900c0fa 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -26,6 +26,7 @@ static int ipv6_gro_pull_exthdrs(struct sk_buff *skb, int off, int proto)
 {
 	const struct net_offload *ops = NULL;
 	struct ipv6_opt_hdr *opth;
+	int exthdr_cnt = 0;
 
 	for (;;) {
 		int len;
@@ -38,6 +39,13 @@ static int ipv6_gro_pull_exthdrs(struct sk_buff *skb, int off, int proto)
 		if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
 			break;
 
+		/* Same limit as ip6_protocol_deliver_rcu().
+		 * @proto is left pointing to an extension header,
+		 * so that the caller does not aggregate this packet.
+		 */
+		if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
+			break;
+
 		opth = skb_gro_header(skb, off + sizeof(*opth), off);
 		if (unlikely(!opth))
 			break;
-- 
2.53.0