| Message ID | 4c156bee64fa58bacb808cead7a7f43d531fd587.1677888566.git.lucien.xin@gmail.com |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | netfilter: handle ipv6 jumbo packets properly for bridge ovs and tc | expand |
On Fri, Mar 03, 2023 at 07:12:37PM -0500, Xin Long wrote: > When checking Hop-by-hop option header, if the option data is in > nonlinear area, it should do pskb_may_pull instead of discarding > the skb as a bad IPv6 packet. > > Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> > --- > net/bridge/br_netfilter_ipv6.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c > index 6b07f30675bb..5cd3e4c35123 100644 > --- a/net/bridge/br_netfilter_ipv6.c > +++ b/net/bridge/br_netfilter_ipv6.c > @@ -45,14 +45,18 @@ > */ > static int br_nf_check_hbh_len(struct sk_buff *skb) > { > - unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); > + int len, off = sizeof(struct ipv6hdr); > + unsigned char *nh; > u32 pkt_len; > - const unsigned char *nh = skb_network_header(skb); > - int off = raw - nh; > - int len = (raw[1] + 1) << 3; > > - if ((raw + len) - skb->data > skb_headlen(skb)) > + if (!pskb_may_pull(skb, off + 8)) > goto bad; > + nh = (u8 *)(ipv6_hdr(skb) + 1); nit: if you need so spin a v2 perhaps it would be worth considering reconciling the type of nh (unsigned char *) with the type of the cast above (u8 *). > + len = (nh[1] + 1) << 3; > + > + if (!pskb_may_pull(skb, off + len)) > + goto bad; > + nh = skb_network_header(skb); > > off += 2; > len -= 2; > -- > 2.39.1 >
On 04/03/2023 02:12, Xin Long wrote: > When checking Hop-by-hop option header, if the option data is in > nonlinear area, it should do pskb_may_pull instead of discarding > the skb as a bad IPv6 packet. > > Signed-off-by: Xin Long <lucien.xin@gmail.com> > --- > net/bridge/br_netfilter_ipv6.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Xin Long <lucien.xin@gmail.com> writes: > When checking Hop-by-hop option header, if the option data is in > nonlinear area, it should do pskb_may_pull instead of discarding > the skb as a bad IPv6 packet. > > Signed-off-by: Xin Long <lucien.xin@gmail.com> > --- Reviewed-by: Aaron Conole <aconole@redhat.com> > net/bridge/br_netfilter_ipv6.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c > index 6b07f30675bb..5cd3e4c35123 100644 > --- a/net/bridge/br_netfilter_ipv6.c > +++ b/net/bridge/br_netfilter_ipv6.c > @@ -45,14 +45,18 @@ > */ > static int br_nf_check_hbh_len(struct sk_buff *skb) > { > - unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); > + int len, off = sizeof(struct ipv6hdr); > + unsigned char *nh; > u32 pkt_len; > - const unsigned char *nh = skb_network_header(skb); > - int off = raw - nh; > - int len = (raw[1] + 1) << 3; > > - if ((raw + len) - skb->data > skb_headlen(skb)) > + if (!pskb_may_pull(skb, off + 8)) > goto bad; > + nh = (u8 *)(ipv6_hdr(skb) + 1); > + len = (nh[1] + 1) << 3; > + > + if (!pskb_may_pull(skb, off + len)) > + goto bad; > + nh = skb_network_header(skb); > > off += 2; > len -= 2;
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c index 6b07f30675bb..5cd3e4c35123 100644 --- a/net/bridge/br_netfilter_ipv6.c +++ b/net/bridge/br_netfilter_ipv6.c @@ -45,14 +45,18 @@ */ static int br_nf_check_hbh_len(struct sk_buff *skb) { - unsigned char *raw = (u8 *)(ipv6_hdr(skb) + 1); + int len, off = sizeof(struct ipv6hdr); + unsigned char *nh; u32 pkt_len; - const unsigned char *nh = skb_network_header(skb); - int off = raw - nh; - int len = (raw[1] + 1) << 3; - if ((raw + len) - skb->data > skb_headlen(skb)) + if (!pskb_may_pull(skb, off + 8)) goto bad; + nh = (u8 *)(ipv6_hdr(skb) + 1); + len = (nh[1] + 1) << 3; + + if (!pskb_may_pull(skb, off + len)) + goto bad; + nh = skb_network_header(skb); off += 2; len -= 2;
When checking Hop-by-hop option header, if the option data is in nonlinear area, it should do pskb_may_pull instead of discarding the skb as a bad IPv6 packet. Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/bridge/br_netfilter_ipv6.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)