From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D9343F2113 for ; Tue, 28 Apr 2026 11:24:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777375498; cv=none; b=cU3gUzigbYtIHtQaRkm1MUc1HA4P/dJc291ILf3QGoC96htWfToc6Aj+Nx9iUAsNooB706goohGemUlgLvHTpCexmwYudBIhG45+pOyNRyftnIW9BaVAiWmzSKjmcyxs8hBB120bNLA8ibxqg1hUGtHM3jASgGn0NYTjYXfIR4I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777375498; c=relaxed/simple; bh=dB/ynnwMrqlWTCloUoctRJBoyb577PU1lz+xaLW6ppY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=hYlbDshSlgG4/bULQuWsAldYl3NFUx1cMQX3uEBdSkWHcdFwmsyKXcEMEinxZqeAjOEizZSGae+HaAfKRnuIeq4OJdxPij2c0g+dv/kSZ3deo9oMBW2GNgnge7IXkPXHbeHJMZ4i3LkYfNRs1CUa9srK7Oqw6D3v1GQARwLgxVQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=cgUjOLwc; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=pQhWKqJg; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="cgUjOLwc"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="pQhWKqJg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1777375496; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Q3jk6Fo1QHm8Ghha7OWGjPXMfwmrBwT2+lWSiFlXStk=; b=cgUjOLwcXR9Sex1BsF/4XWGOB8Ps1Wgf7yvL/MP2VKWvcxbrmjsjQ7SZEM2N3e5zD4h5kZ c7qMf+XawTyAiYW+RjZ+/swe0/uvh3Sgj3Ohu+CC7egDXKxja2+fZ4ByqXxRnlJ75VQvXW c+pI3oXjkmA+lrThp2bewcMxTYooh9Y= Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-126-0PpjGmwIMn6A9_mBgmdzNg-1; Tue, 28 Apr 2026 07:24:55 -0400 X-MC-Unique: 0PpjGmwIMn6A9_mBgmdzNg-1 X-Mimecast-MFC-AGG-ID: 0PpjGmwIMn6A9_mBgmdzNg_1777375494 Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-8ac04b2fc4eso64400136d6.0 for ; Tue, 28 Apr 2026 04:24:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1777375494; x=1777980294; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Q3jk6Fo1QHm8Ghha7OWGjPXMfwmrBwT2+lWSiFlXStk=; b=pQhWKqJg9MkPbVpLV85kcOciOz/4Hmn6nhjYIkZLMJULS7LyjJBWhpVIkHrUIfafxj 2L+owSvt9ZdOn/TmfaSlAnlUX4+l/fxfYwYXSytNvwe+Pu1EjSQNUdk5tQjuNo7B3rtR 9Bf9fvd3FKPviVPRuNdu16qtTamgRPOsA4yvBcdR+Akxgq3i+cOYnuOooW7nq8aDbehc KVCgPZrI5uuy+fBonIlh62vk5yd/RGxpYow9hGgrQEvkHXXcIAcmAFR1Tdg+BiUnCdEm N85RC9rUKhwRuxAGY8YpsX5DDrcnZ/7PAHfT8oiqmsWnRCD5B86zaDnjsqCbhO1tYOcf LNFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777375494; x=1777980294; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Q3jk6Fo1QHm8Ghha7OWGjPXMfwmrBwT2+lWSiFlXStk=; b=TwmC9ZQYg89j850mkh15RrgiFYFimpIXDQMm0urlqwiU6wKM/ad+BmAvlx0lH32m+z XkPKge3cBWE3A/+bRyLr11RZKGco6GNdAmr4GhWVZd1wDVcry41/NeBYmBjD0lLPK9Po cDRbdA3hh1zxQpee3f/sFlfLhtlb9TMIerSKjbxbE/ea/Fj+rUhWtHpAzOivH9/PHcXR dJWfXdaIzr/z/At5+S1YbDeWX23m6kQXUoP25I93mLaPr1fPA5/rrAg1hnnmGLLarvoh 3HuRy2mPpbR2WQuaWhli0A00GtcIrjQJFXqp+4rPYo4Gzjszn/ahnOlJBboejeP1gzmg z3YA== X-Forwarded-Encrypted: i=1; AFNElJ+ZKZ7HNBOhl6UjL4xndkX6OiuWESagaIwfeWvM7l09lGXq0zrOY4UPucWqMy57gYB+F+H0XnTTe2zsWRw=@vger.kernel.org X-Gm-Message-State: AOJu0Yxs4Qy42ik69kXBZNHAk62jPKMLUYT5zZ19PhZvjRFDXSgSGnON Fureo9Kon5sN+1x37BK2sgQFg+cIrIoUNVWgrgUk59NTmpUMPzqUpzJ7h28z+ICXLQI905zmyYq W6NKoVwMKNqhdMdsUQ4aU8g16QONeNGIoGO2UiXOrNTU3utl1kvp1aYiOLJNUf2rRgA== X-Gm-Gg: AeBDieu2eE39MR/abTr4h+gC0XllN6nwiXxdoV4P2/7QO9hA/I7/YwaWJKE6V7//8pF 3HRYXpX06I/ob/KpkQDOVp+c83X80mXLtLE4SGX/+LekmPXMI9PssRRHkPC2E2N51ysoEbLA6Ou G1jXtIH5rDozu8IREmg4Icnf6jUQXfLcVfo4yqK75BcV2w8oH+3ifAOlsjKQMU6VQQYNg1OT9tm BXsunGNr9vL04QjqYf0ZZTE5z2swxDxMf05ZmBiMIfJSLRpc4TBHHPCnvRIoPVPcYd6x1TtbCu3 b5HCble/4YwsmR8lp4FmaHFu/oYe/L124QHkGfV5wJ3brsY9EhsMcHYA4NpvwQmfwtvuV/9ZgD3 tlnoJj2Wx2Pa7X00rwzd696ANVeULoOXSvJDFQpW9J3sbZ+gx7S5v0F/5O4avm2Z8Dw== X-Received: by 2002:a05:6214:f05:b0:8a4:7977:e5fa with SMTP id 6a1803df08f44-8b3e307a767mr41663956d6.25.1777375494314; Tue, 28 Apr 2026 04:24:54 -0700 (PDT) X-Received: by 2002:a05:6214:f05:b0:8a4:7977:e5fa with SMTP id 6a1803df08f44-8b3e307a767mr41663276d6.25.1777375493702; Tue, 28 Apr 2026 04:24:53 -0700 (PDT) Received: from [192.168.88.32] ([216.128.9.114]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8b3e28162easm18673876d6.3.2026.04.28.04.24.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 28 Apr 2026 04:24:53 -0700 (PDT) Message-ID: Date: Tue, 28 Apr 2026 13:24:51 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net v3] ipv6: validate extension header length before copying to cmsg To: Qi Tang , "David S . Miller" , David Ahern , Eric Dumazet , Jakub Kicinski , Simon Horman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260423103238.3987364-1-tpluszz77@gmail.com> Content-Language: en-US From: Paolo Abeni In-Reply-To: <20260423103238.3987364-1-tpluszz77@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 4/23/26 12:32 PM, Qi Tang wrote: > ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} > cmsgs (and their IPV6_2292* legacy counterparts) by trusting the > on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. > The length was validated only at parse time (ipv6_parse_hopopts(), > etc.). An nftables payload-write expression can rewrite hdrlen after > parsing and before the skb reaches recvmsg; the write itself is > in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040 > bytes from an 8-byte header. nftables is reachable from an > unprivileged user namespace, so this is an unprivileged > slab-out-of-bounds read: > > BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540 > put_cmsg+0x3ac/0x540 > udpv6_recvmsg+0xca0/0x1250 > sock_recvmsg+0xdf/0x190 > ____sys_recvmsg+0x1b1/0x620 > > Add ipv6_get_exthdr_len() which computes the extension header length > and validates it against skb_tail_pointer(skb), returning 0 on > failure. Extension headers are kept in the linear skb area by > pskb_may_pull() during input, so skb_tail_pointer() is the correct > bound. > > Use ipv6_get_exthdr_len() at all non-AH call sites: the five > standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR) > and the three standard cases in the extension-header walk loop > (DSTOPTS, ROUTING, default). AH retains an inline bounds check > because its length formula differs ((ptr[1]+2)<<2). > > When the walk loop detects a corrupted header, return from the > function instead of continuing to process later socket options. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Qi Tang > --- > Changes v2 -> v3: > - Resend as new thread (v2 was incorrectly sent as reply to v1) > > Changes v1 -> v2 (Paolo Abeni): > - Factor repeated bounds-check + put_cmsg into ipv6_get_exthdr_len() > - Return from the function on corrupted walk-loop entry instead of > goto + empty label > > v2: https://lore.kernel.org/netdev/20260423102255.3752004-1-tpluszz77@gmail.com/ > v1: https://lore.kernel.org/netdev/20260419150344.624673-1-tpluszz77@gmail.com/ > > net/ipv6/datagram.c | 46 +++++++++++++++++++++++++++++++++++++-------- > 1 file changed, 38 insertions(+), 8 deletions(-) > > diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c > index 972bf0426d59..0a7b74d5f402 100644 > --- a/net/ipv6/datagram.c > +++ b/net/ipv6/datagram.c > @@ -617,6 +617,13 @@ void ip6_datagram_recv_common_ctl(struct sock *sk, struct msghdr *msg, > } > } > > +static u16 ipv6_get_exthdr_len(const struct sk_buff *skb, const u8 *ptr) > +{ > + u16 len = (ptr[1] + 1) << 3; Sashiko notes that you should validate even this offset (1) before accessing it. You may also consider switching to pskb_may_pull(). /P