Re: [PATCH] net: ipv4: ipconfig: fix OOB read in DHCP option parsing

[Antoine Tenart <atenart@kernel.org>]

On Fri, Oct 16, 2026 at 12:11:52PM +0800, Liu Chao wrote:
> The DHCP option parser in ic_bootp_recv() advances the option
> pointer by the option length and only checks that the new pointer
> has not reached the end of the packet.  The length byte and the
> option payload (opt[1], opt[2]) are then read without verifying
> that they lie within the buffer, so a malformed reply from a
> rogue DHCP server can trigger an out-of-bounds read.
> 
> Validate the option length against the remaining bytes before
> consuming the option, and skip options that do not fit.  This
> keeps the existing parsing logic intact while ensuring all reads
> stay within the received packet.
> 
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  net/ipv4/ipconfig.c | 38 ++++++++++++++++++++------------------
>  1 file changed, 20 insertions(+), 18 deletions(-)
> 
> diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
> index 22a788987..0b39a5ccf 100644
> --- a/net/ipv4/ipconfig.c
> +++ b/net/ipv4/ipconfig.c
> @@ -1081,25 +1081,27 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
>  			__be32 server_id = NONE;
>  			int mt = 0;
>  
> -			ext = &b->exten[4];
> -			while (ext < end && *ext != 0xff) {
> -				u8 *opt = ext++;
> -				if (*opt == 0)	/* Padding */
> -					continue;
> -				ext += *ext + 1;
> -				if (ext >= end)
> -					break;
> -				switch (*opt) {
> -				case 53:	/* Message type */
> -					if (opt[1])
> -						mt = opt[2];
> -					break;
> -				case 54:	/* Server ID (IP address) */
> -					if (opt[1] >= 4)
> -						memcpy(&server_id, opt + 2, 4);
> -					break;
> +				ext = &b->exten[4];
> +				while (ext < end && *ext != 0xff) {
> +					u8 *opt = ext++;
> +					if (*opt == 0)	/* Padding */
> +						continue;
> +					if (ext >= end)
> +						break;
> +					ext += *ext + 1;
> +					if (ext > end)
> +						break;
> +					switch (*opt) {
> +					case 53:	/* Message type */
> +						if (opt[1])
> +							mt = opt[2];
> +						break;
> +					case 54:	/* Server ID (IP address) */
> +						if (opt[1] >= 4)
> +							memcpy(&server_id, opt + 2, 4);
> +						break;
> +					}
>  				}
> -			}

Please fix the indentation.

Isn't there a similar issue later in that function?