[PATCH] xfrm: input: fix 4-bit iph->ihl overflow and OOB read in xfrm4_remove_beet_encap()

[PATCH] xfrm: input: fix 4-bit iph->ihl overflow and OOB read in xfrm4_remove_beet_encap()

[Hui Peng]

In xfrm4_remove_beet_encap(), when the BEET pseudo-header is present
(XFRM_MODE_SKB_CB(skb)->protocol == IPPROTO_BEETPH), two validation
flaws exist in option decapsulation:

1. optlen is checked against `optlen > 250` instead of `MAX_IPOPTLEN`
   (40). Later, `iph->ihl += optlen / 4` adds up to 62 to the 4-bit
   `iph->ihl` field (which starts at 5), wrapping the 4-bit unsigned
   bitfield around 16 and producing a bogus IPv4 header length smaller
   than 20 bytes.
2. Only `pskb_may_pull(skb, phlen)` is checked before `__skb_pull(skb,
   phlen)` and `ip_fast_csum(skb_network_header(skb), iph->ihl)`. If the
   trailing `optlen` bytes reside in non-linear skb fragments (or beyond
   the packet), `ip_fast_csum()` reads `optlen` bytes past
   `skb_tail_pointer(skb)`.

Cap `optlen` at `MAX_IPOPTLEN` (40) and ensure `pskb_may_pull(skb, phlen
+ optlen)` succeeds before pulling `phlen`.

Fixes: 0a69452cb45a ("[XFRM]: BEET mode")
Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/xfrm/xfrm_input.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 5ed87d51392a..3ed5fb0c755c 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -197,12 +197,12 @@ static int xfrm4_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb)
 
 		phlen = sizeof(*ph) + ph->padlen;
 		optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen);
-		if (optlen < 0 || optlen & 3 || optlen > 250)
+		if (optlen < 0 || optlen & 3 || optlen > MAX_IPOPTLEN)
 			goto out;
 
 		XFRM_MODE_SKB_CB(skb)->protocol = ph->nexthdr;
 
-		if (!pskb_may_pull(skb, phlen))
+		if (!pskb_may_pull(skb, phlen + optlen))
 			goto out;
 		__skb_pull(skb, phlen);
 	}
-- 
2.55.0.1082.g2b9226bbc0-goog