netdev - Re: [RFC net-next 1/3] ipv6: Check of max HBH or DestOp sysctl is zero and drop if it is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALx6S347Pj82aFnV9=ghMQab+sQV=tM5eMSMjWaRC3rnJ0bc8Q@mail.gmail.com>
Date: Fri, 21 Nov 2025 13:24:33 -0800
From: Tom Herbert <tom@...bertland.com>
To: Justin Iurman <justin.iurman@...ege.be>
Cc: davem@...emloft.net, kuba@...nel.org, netdev@...r.kernel.org
Subject: Re: [RFC net-next 1/3] ipv6: Check of max HBH or DestOp sysctl is
 zero and drop if it is

On Thu, Nov 13, 2025 at 5:17 AM Justin Iurman <justin.iurman@...ege.be> wrote:
>
> On 11/12/25 01:15, Tom Herbert wrote:
> > In IPv6 destitaion options processing function check if
>
> s/destitaion/destination
>
> > net->ipv6.sysctl.max_dst_opts_cnt is zero up front. If is zero then
> > drop the packet since Destination Options processing is disabled.
> >
> > Similarly, in IPv6 hop-by-hop options processing function check if
> > net->ipv6.sysctl.max_hbh_opts_cnt is zero up front. If is zero then
> > drop the packet since Hop-by-Hop Options processing is disabled.
> > ---
> >   net/ipv6/exthdrs.c | 6 ++++--
> >   1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> > index a23eb8734e15..11ff3d4df129 100644
> > --- a/net/ipv6/exthdrs.c
> > +++ b/net/ipv6/exthdrs.c
> > @@ -303,7 +303,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
> >       struct net *net = dev_net(skb->dev);
> >       int extlen;
> >
> > -     if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
> > +     if (!net->ipv6.sysctl.max_dst_opts_cnt ||
> > +         !pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
> >           !pskb_may_pull(skb, (skb_transport_offset(skb) +
> >                                ((skb_transport_header(skb)[1] + 1) << 3)))) {
> >               __IP6_INC_STATS(dev_net(dst_dev(dst)), idev,
> > @@ -1040,7 +1041,8 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
> >        * sizeof(struct ipv6hdr) by definition of
> >        * hop-by-hop options.
> >        */
> > -     if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
> > +     if (!net->ipv6.sysctl.max_hbh_opts_cnt ||
> > +         !pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
> >           !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
> >                                ((skb_transport_header(skb)[1] + 1) << 3)))) {
> >   fail_and_free:
>
> IMO, this patch is necessary, whether or not this series is applied at
> some point.

Agreed. Thanks!

Tom

>
> Despite being an RFC:
>
> Reviewed-by: Justin Iurman <justin.iurman@...ege.be>