netdev - Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <688a4f3f7d969_1d29db294cf@willemb.c.googlers.com.notmuch>
Date: Wed, 30 Jul 2025 12:58:39 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Eric Dumazet <edumazet@...gle.com>, 
 "David S . Miller" <davem@...emloft.net>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, 
 Willem de Bruijn <willemb@...gle.com>, 
 David Ahern <dsahern@...nel.org>, 
 netdev@...r.kernel.org, 
 eric.dumazet@...il.com, 
 Eric Dumazet <edumazet@...gle.com>, 
 syzbot+af43e647fd835acc02df@...kaller.appspotmail.com
Subject: Re: [PATCH net] ipv6: reject malicious packets in ipv6_gso_segment()

Eric Dumazet wrote:
> syzbot was able to craft a packet with very long IPv6 extension headers
> leading to an overflow of skb->transport_header.
> 
> This 16bit field has a limited range.
> 
> Add skb_reset_transport_header_careful() helper and use it
> from ipv6_gso_segment()
> 
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
> WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Modules linked in:
> CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
>  RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
>  RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
> Call Trace:
>  <TASK>
>   skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
>   nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
>   skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
>   __skb_gso_segment+0x342/0x510 net/core/gso.c:124
>   skb_gso_segment include/net/gso.h:83 [inline]
>   validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
>   validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
>   sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
>   __dev_xmit_skb net/core/dev.c:4102 [inline]
>   __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
> 
> Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support")
> Reported-by: syzbot+af43e647fd835acc02df@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>