Eric Dumazet
5dc60b2a00
ipv6: reject malicious packets in ipv6_gso_segment()
[ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ]
syzbot was able to craft a packet with very long IPv6 extension headers
leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skb_reset_transport_header_careful() helper and use it
from ipv6_gso_segment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Modules linked in:
CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Call Trace:
<TASK>
skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
__skb_gso_segment+0x342/0x510 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
__dev_xmit_skb net/core/dev.c:4102 [inline]
__dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
Fixes: d1da932ed4 ("ipv6: Separate ipv6 offload support")
Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2025-08-28 16:21:22 +02:00 |
| .. |
|
ila
|
net: ipv6: fix missing dst ref drop in ila lwtunnel
|
2025-03-13 12:43:30 +01:00 |
|
netfilter
|
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
|
2025-06-27 11:02:47 +01:00 |
|
addrconf.c
|
ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
|
2025-04-10 14:29:43 +02:00 |
|
addrconf_core.c
|
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
|
2024-02-23 08:25:04 +01:00 |
|
addrlabel.c
|
|
|
|
af_inet6.c
|
net: inet6: do not leave a dangling sk pointer in inet6_create()
|
2024-12-14 19:44:51 +01:00 |
|
ah6.c
|
|
|
|
anycast.c
|
|
|
|
calipso.c
|
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
|
2025-06-27 11:02:57 +01:00 |
|
datagram.c
|
|
|
|
esp6.c
|
net: ipv6: fix return value check in esp_remove_trailer
|
2023-10-25 11:53:21 +02:00 |
|
esp6_offload.c
|
xfrm: Linearize the skb after offloading if needed.
|
2023-06-28 10:18:38 +02:00 |
|
exthdrs.c
|
|
|
|
exthdrs_core.c
|
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
|
2023-05-30 12:44:10 +01:00 |
|
exthdrs_offload.c
|
|
|
|
fib6_notifier.c
|
|
|
|
fib6_rules.c
|
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
|
2025-06-04 14:32:34 +02:00 |
|
fou6.c
|
|
|
|
icmp.c
|
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
|
2023-07-27 08:37:31 +02:00 |
|
inet6_connection_sock.c
|
|
|
|
inet6_hashtables.c
|
|
|
|
ip6_checksum.c
|
|
|
|
ip6_fib.c
|
ipv6: fix possible race in __fib6_drop_pcpu_from()
|
2024-07-05 09:08:13 +02:00 |
|
ip6_flowlabel.c
|
treewide: Remove uninitialized_var() usage
|
2023-06-09 10:29:01 +02:00 |
|
ip6_gre.c
|
erspan: make sure erspan_base_hdr is present in skb->head
|
2024-04-13 12:51:36 +02:00 |
|
ip6_icmp.c
|
|
|
|
ip6_input.c
|
|
|
|
ip6_offload.c
|
ipv6: reject malicious packets in ipv6_gso_segment()
|
2025-08-28 16:21:22 +02:00 |
|
ip6_offload.h
|
|
|
|
ip6_output.c
|
ipv6: prevent possible UAF in ip6_xmit()
|
2025-01-09 13:23:33 +01:00 |
|
ip6_tunnel.c
|
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
|
2024-01-25 14:34:26 -08:00 |
|
ip6_udp_tunnel.c
|
|
|
|
ip6_vti.c
|
ip6_vti: fix slab-use-after-free in decode_session6
|
2023-08-30 16:27:16 +02:00 |
|
ip6mr.c
|
ipmr: convert /proc handlers to rcu_read_lock()
|
2024-12-14 19:44:33 +01:00 |
|
ipcomp6.c
|
|
|
|
ipv6_sockglue.c
|
tcp: Fix data races around icsk->icsk_af_ops.
|
2024-07-05 09:08:32 +02:00 |
|
Kconfig
|
|
|
|
Makefile
|
|
|
|
mcast.c
|
|
|
|
mcast_snoop.c
|
|
|
|
mip6.c
|
|
|
|
ndisc.c
|
ndisc: extend RCU protection in ndisc_send_skb()
|
2025-03-13 12:43:18 +01:00 |
|
netfilter.c
|
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
|
2025-06-27 11:02:46 +01:00 |
|
output_core.c
|
|
|
|
ping.c
|
ping6: Fix send to link-local addresses with VRF.
|
2023-06-21 15:44:11 +02:00 |
|
proc.c
|
|
|
|
protocol.c
|
|
|
|
raw.c
|
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
|
2023-06-05 08:17:33 +02:00 |
|
reassembly.c
|
|
|
|
route.c
|
net: ipv6: Discard next-hop MTU less than minimum link MTU
|
2025-07-17 18:25:06 +02:00 |
|
seg6.c
|
ipv6: sr: fix invalid unregister error path
|
2024-06-16 13:28:38 +02:00 |
|
seg6_hmac.c
|
ipv6: sr: fix memleak in seg6_hmac_init_algo
|
2024-06-16 13:28:45 +02:00 |
|
seg6_iptunnel.c
|
ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
|
2024-07-05 09:08:11 +02:00 |
|
seg6_local.c
|
|
|
|
sit.c
|
|
|
|
syncookies.c
|
dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
|
2023-11-20 10:30:15 +01:00 |
|
sysctl_net_ipv6.c
|
|
|
|
tcp_ipv6.c
|
net: fix data-races around sk->sk_forward_alloc
|
2025-02-01 18:18:52 +01:00 |
|
tcpv6_offload.c
|
|
|
|
tunnel6.c
|
|
|
|
udp.c
|
udp: gso: do not drop small packets when PMTU reduces
|
2025-03-13 12:43:06 +01:00 |
|
udp_impl.h
|
|
|
|
udp_offload.c
|
|
|
|
udplite.c
|
udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
|
2023-05-30 12:44:09 +01:00 |
|
xfrm6_input.c
|
xfrm: Preserve vlan tags for transport mode software GRO
|
2024-05-17 11:43:53 +02:00 |
|
xfrm6_output.c
|
|
|
|
xfrm6_policy.c
|
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
|
2024-07-05 09:08:22 +02:00 |
|
xfrm6_protocol.c
|
|
|
|
xfrm6_state.c
|
|
|
|
xfrm6_tunnel.c
|
|
|