[PATCH] net: net6: validate IPv6 payload and UDP length on receive

[PATCH] net: net6: validate IPv6 payload and UDP length on receive

[Esteban Alba via B4 Relay]

From: Esteban Alba <estebancalba@gmail.com>

net_ip6_handler() checks the received length only against IP6_HDR_SIZE
and then uses two length fields from the packet without checking them.
The checksum is computed over payload_len, but the length passed to the
UDP handler comes from udp_len. A sender can keep payload_len correct so
the checksum still validates and set udp_len larger than the frame. A
handler that trusts that length then reads or writes past the receive
buffer. The DHCPv6 client copies the declared number of bytes and can be
made to write past the packet buffer from a single link-local ADVERTISE.

The IPv4 path already reconciles these lengths in
net_process_received_packet(). Do the same here: reject a payload_len
that exceeds the received length and trim len to it, then reject a
udp_len smaller than the UDP header or larger than the payload before
calling the handler.

Fixes: 1feb697830ce ("net: ipv6: Add implementation of main IPv6 functions")
Signed-off-by: Esteban Alba <estebancalba@gmail.com>
Cc: Jerome Forissier <jerome.forissier@arm.com>
Cc: Tom Rini <trini@konsulko.com>
---
 net/net6.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/net6.c b/net/net6.c
index 4cff98df15..af2f484fad 100644
--- a/net/net6.c
+++ b/net/net6.c
@@ -392,6 +392,11 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 	if (ip6->version != 6)
 		return -EINVAL;
 
+	/* Trim to the length declared in the header, as the IPv4 path does */
+	if (len < IP6_HDR_SIZE + ntohs(ip6->payload_len))
+		return -EINVAL;
+	len = IP6_HDR_SIZE + ntohs(ip6->payload_len);
+
 	switch (ip6->nexthdr) {
 	case PROT_ICMPV6:
 		icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
@@ -433,6 +438,10 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 		if (csum != udp->udp_xsum)
 			return -EINVAL;
 
+		if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
+		    ntohs(udp->udp_len) > len - IP6_HDR_SIZE)
+			return -EINVAL;
+
 		/* IP header OK. Pass the packet to the current handler. */
 		net_get_udp_handler()((uchar *)ip6 + IP6_HDR_SIZE +
 					UDP_HDR_SIZE,

---
base-commit: ece349ade2973e220f524ce59e59711cc919263f
change-id: 20260807-net6-len-validation-cd71efd96a7f

Best regards,
--  
Esteban Alba <estebancalba@gmail.com>

Re: [PATCH] net: net6: validate IPv6 payload and UDP length on receive

[Jerome Forissier]

Hi Esteban,

On 08/08/2026 04:09, Esteban Alba via B4 Relay wrote:
> From: Esteban Alba <estebancalba@gmail.com>
> 
> net_ip6_handler() checks the received length only against IP6_HDR_SIZE
> and then uses two length fields from the packet without checking them.
> The checksum is computed over payload_len, but the length passed to the
> UDP handler comes from udp_len. A sender can keep payload_len correct so
> the checksum still validates and set udp_len larger than the frame. A
> handler that trusts that length then reads or writes past the receive
> buffer. The DHCPv6 client copies the declared number of bytes and can be
> made to write past the packet buffer from a single link-local ADVERTISE.
> 
> The IPv4 path already reconciles these lengths in
> net_process_received_packet(). Do the same here: reject a payload_len
> that exceeds the received length and trim len to it, then reject a
> udp_len smaller than the UDP header or larger than the payload before
> calling the handler.
> 
> Fixes: 1feb697830ce ("net: ipv6: Add implementation of main IPv6 functions")
> Signed-off-by: Esteban Alba <estebancalba@gmail.com>
> Cc: Jerome Forissier <jerome.forissier@arm.com>
> Cc: Tom Rini <trini@konsulko.com>
> ---
>  net/net6.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/net/net6.c b/net/net6.c
> index 4cff98df15..af2f484fad 100644
> --- a/net/net6.c
> +++ b/net/net6.c
> @@ -392,6 +392,11 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
>  	if (ip6->version != 6)
>  		return -EINVAL;
>  
> +	/* Trim to the length declared in the header, as the IPv4 path does */
> +	if (len < IP6_HDR_SIZE + ntohs(ip6->payload_len))
> +		return -EINVAL;
> +	len = IP6_HDR_SIZE + ntohs(ip6->payload_len);
> +
>  	switch (ip6->nexthdr) {
>  	case PROT_ICMPV6:
>  		icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
> @@ -433,6 +438,10 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
>  		if (csum != udp->udp_xsum)
>  			return -EINVAL;
>  
> +		if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
> +		    ntohs(udp->udp_len) > len - IP6_HDR_SIZE)
> +			return -EINVAL;
> +
>  		/* IP header OK. Pass the packet to the current handler. */
>  		net_get_udp_handler()((uchar *)ip6 + IP6_HDR_SIZE +
>  					UDP_HDR_SIZE,
> 

I still see a couple of issues in this code. In the UDP path, udp->udp_xsum
is accessed before checking that payload_len >= UDP_HDR_SIZE, so a short IPv6
payload can still cause an out-of-bounds access. The ICMPv6 path has the
same issue when accessing struct icmp6hdr.

The transport header size therefore needs to be validated before either
header is dereferenced. The UDP length checks should also be done before
accessing the UDP checksum field.

Something along the following lines:

--- a/net/net6.c
+++ b/net/net6.c
@@ -370,11 +370,19 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 	if (ip6->version != 6)
 		return -EINVAL;
 
+	hlen = ntohs(ip6->payload_len);
+
+	/* Trim to the length declared in the header, as the IPv4 path does */
+	if (len < IP6_HDR_SIZE + hlen)
+		return -EINVAL;
+	len = IP6_HDR_SIZE + hlen;
+
 	switch (ip6->nexthdr) {
 	case PROT_ICMPV6:
+		if (hlen < sizeof(struct icmp6hdr))
+			return -EINVAL;
+
 		icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
 		csum = icmp->icmp6_cksum;
-		hlen = ntohs(ip6->payload_len);
 		icmp->icmp6_cksum = 0;
 		/* checksum */
 		csum_p = csum_partial((u8 *)icmp, hlen, 0);
@@ -398,9 +406,15 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 		}
 		break;
 	case IPPROTO_UDP:
+		if (hlen < UDP_HDR_SIZE)
+			return -EINVAL;
+
 		udp = (struct udp_hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
+		if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
+		    ntohs(udp->udp_len) > hlen)
+			return -EINVAL;
+
 		csum = udp->udp_xsum;
-		hlen = ntohs(ip6->payload_len);
 		udp->udp_xsum = 0;
 		/* checksum */
 		csum_p = csum_partial((u8 *)udp, hlen, 0);


Thanks,
-- 
Jerome

> ---
> base-commit: ece349ade2973e220f524ce59e59711cc919263f
> change-id: 20260807-net6-len-validation-cd71efd96a7f
> 
> Best regards,
> --  
> Esteban Alba <estebancalba@gmail.com>
> 
> 

[PATCH v2] net: net6: validate IPv6 payload and transport lengths on receive

[Esteban Alba via B4 Relay]

From: Esteban Alba <estebancalba@gmail.com>

net_ip6_handler() checks the received length only against IP6_HDR_SIZE and
then uses length fields from the packet without checking them. The checksum
is computed over payload_len, but the UDP handler length comes from
udp_len. A sender can keep payload_len correct so the checksum still
validates and set udp_len larger than the frame. A handler that trusts that
length then reads or writes past the receive buffer. The DHCPv6 client
copies the declared number of bytes and can be made to write past the
packet buffer from a single link-local ADVERTISE.

Validate payload_len against the received length and trim len to it before
protocol dispatch. Validate the ICMPv6 and UDP header sizes before either
header is dereferenced, and validate udp_len before reading udp_xsum or
calling the UDP handler.

Fixes: 1feb697830ce ("net: ipv6: Add implementation of main IPv6 functions")
Suggested-by: Jerome Forissier <jerome.forissier@arm.com>
Signed-off-by: Esteban Alba <estebancalba@gmail.com>
---
Validate the IPv6 payload length against the received frame before protocol
dispatch, then validate the ICMPv6 and UDP transport header sizes and
udp_len before either header is dereferenced or the UDP handler is called.
---
Changes in v2:
- Move payload_len reconciliation before protocol dispatch.
- Validate ICMPv6 and UDP header sizes before dereferencing their headers.
- Validate udp_len before reading udp_xsum or dispatching to the UDP handler.
- Link to v1: https://patch.msgid.link/20260807-net6-len-validation-v1-1-edff271cbf2c@gmail.com

To: u-boot@lists.u-boot-project.org
Cc: Ramon Fried <rfried.dev@gmail.com>
Cc: Jerome Forissier <jerome.forissier@arm.com>
Cc: Tom Rini <trini@konsulko.com>
Cc: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Cc: Simon Glass <sjg@chromium.org>
---
 net/net6.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/net/net6.c b/net/net6.c
index 4cff98df15..e1a455748e 100644
--- a/net/net6.c
+++ b/net/net6.c
@@ -392,11 +392,19 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 	if (ip6->version != 6)
 		return -EINVAL;
 
+	hlen = ntohs(ip6->payload_len);
+
+	if (len < IP6_HDR_SIZE + hlen)
+		return -EINVAL;
+	len = IP6_HDR_SIZE + hlen;
+
 	switch (ip6->nexthdr) {
 	case PROT_ICMPV6:
+		if (hlen < sizeof(struct icmp6hdr))
+			return -EINVAL;
+
 		icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
 		csum = icmp->icmp6_cksum;
-		hlen = ntohs(ip6->payload_len);
 		icmp->icmp6_cksum = 0;
 		/* checksum */
 		csum_p = csum_partial((u8 *)icmp, hlen, 0);
@@ -421,9 +429,15 @@ int net_ip6_handler(struct ethernet_hdr *et, struct ip6_hdr *ip6, int len)
 		}
 		break;
 	case IPPROTO_UDP:
+		if (hlen < UDP_HDR_SIZE)
+			return -EINVAL;
+
 		udp = (struct udp_hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
+		if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
+		    ntohs(udp->udp_len) > hlen)
+			return -EINVAL;
+
 		csum = udp->udp_xsum;
-		hlen = ntohs(ip6->payload_len);
 		udp->udp_xsum = 0;
 		/* checksum */
 		csum_p = csum_partial((u8 *)udp, hlen, 0);

---
base-commit: ece349ade2973e220f524ce59e59711cc919263f
change-id: 20260807-net6-len-validation-cd71efd96a7f

Best regards,
--  
Esteban Alba <estebancalba@gmail.com>