Re: [PATCH net v5 2/2] ip: reject partial checksums covering network headers

[sashiko-bot@kernel.org]

> ip_do_fragment() and nf_br_ip_fragment() complete a CHECKSUM_PARTIAL skb
> before reading the IPv4 header length. ip6_fragment() and br_ip6_fragment()
> complete one after parsing the IPv6 header chain. A virtualization
> interface can supply a checksum start which, after link-layer removal,
> still points inside that parsed network header.
> 
> skb_checksum_help() then writes the completed checksum into header bytes
> the stack has already consumed. For IPv4, changing iph->ihl after routing
> and validation can make fragmentation copy beyond the skb's logical linear
> head into transmitted options. A negative checksum-start offset is rejected
> by skb_checksum_help(), but only after a WARN_ONCE which can panic a
> panic_on_warn system.
> 
> Validate the checksum start against the parsed header length before
> completing it. For IPv4, read and validate IHL first, retain it, and
> reacquire iph after skb_checksum_help() in both implementations. For IPv6,
> use the length returned by ip6_find_1stfragopt() in both implementations.
> 
> Compare the signed checksum-start offset with the bounded signed header
> length so integer promotion cannot bypass either boundary.
> 
> Fixes: dbd3393c56a8 ("ipv4: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment")
> Fixes: 405c92f7a541 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment")
> Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
> Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
> Reported-by: Paulos Yibelo <habte.yibelo@gmail.com>
> Link: https://lore.kernel.org/netdev/20260920004733.6473-3-habte.yibelo@gmail.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Paulos Yibelo <habte.yibelo@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921025341.44846-1-habte.yibelo@gmail.com?part=2