netdev - [PATCH] net: exit immediately when encounter ipv6 fragment in skb_checksum_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Aug 2020 07:21:59 -0400
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     <davem@...emloft.net>, <kuba@...nel.org>, <pshelar@....org>,
        <fw@...len.de>, <martin.varghese@...ia.com>, <edumazet@...gle.com>,
        <dcaratti@...hat.com>, <steffen.klassert@...unet.com>,
        <pabeni@...hat.com>, <shmulik@...anetworks.com>,
        <kyk.segfault@...il.com>
CC:     <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linmiaohe@...wei.com>
Subject: [PATCH] net: exit immediately when encounter ipv6 fragment in skb_checksum_setup_ipv6()

skb_checksum_setup_ipv6() always return -EPROTO if ipv6 packet is fragment.
So we should not continue to parse other header type in this case. Also
remove unnecessary local variable 'fragment'.

Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>
---
 net/core/skbuff.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c3496bd8e99e..4dc92290becd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4894,11 +4894,9 @@ static int skb_checksum_setup_ipv6(struct sk_buff *skb, bool recalculate)
 	u8 nexthdr;
 	unsigned int off;
 	unsigned int len;
-	bool fragment;
 	bool done;
 	__sum16 *csum;
 
-	fragment = false;
 	done = false;
 
 	off = sizeof(struct ipv6hdr);
@@ -4956,8 +4954,11 @@ static int skb_checksum_setup_ipv6(struct sk_buff *skb, bool recalculate)
 
 			hp = OPT_HDR(struct frag_hdr, skb, off);
 
-			if (hp->frag_off & htons(IP6_OFFSET | IP6_MF))
-				fragment = true;
+			/* Exit immediately when encounter ipv6 fragment. */
+			if (hp->frag_off & htons(IP6_OFFSET | IP6_MF)) {
+				err = -EPROTO;
+				goto out;
+			}
 
 			nexthdr = hp->nexthdr;
 			off += sizeof(struct frag_hdr);
@@ -4970,8 +4971,7 @@ static int skb_checksum_setup_ipv6(struct sk_buff *skb, bool recalculate)
 	}
 
 	err = -EPROTO;
-
-	if (!done || fragment)
+	if (!done)
 		goto out;
 
 	csum = skb_checksum_setup_ip(skb, nexthdr, off);
-- 
2.19.1