Files
linux/include/linux
Eric Dumazet ef05007b40 ipv6: reject malicious packets in ipv6_gso_segment()
[ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ]

syzbot was able to craft a packet with very long IPv6 extension headers
leading to an overflow of skb->transport_header.

This 16bit field has a limited range.

Add skb_reset_transport_header_careful() helper and use it
from ipv6_gso_segment()

WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Modules linked in:
CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
 RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Call Trace:
 <TASK>
  skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
  nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
  skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
  __skb_gso_segment+0x342/0x510 net/core/gso.c:124
  skb_gso_segment include/net/gso.h:83 [inline]
  validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
  validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
  sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
  __dev_xmit_skb net/core/dev.c:4102 [inline]
  __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679

Fixes: d1da932ed4 ("ipv6: Separate ipv6 offload support")
Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-15 12:09:02 +02:00
..
2022-11-04 12:59:25 +02:00
2023-06-16 12:27:04 -06:00
2023-05-20 19:20:30 +02:00
2025-05-09 09:43:58 +02:00
2023-08-23 08:21:37 +01:00
2024-07-25 09:50:47 +02:00
2023-09-11 15:24:16 -07:00
2023-01-19 14:46:25 +01:00
2024-10-04 16:29:59 +02:00
2024-06-12 11:11:38 +02:00
2023-05-31 13:06:57 +02:00
2022-09-26 10:13:13 -07:00
2023-01-13 11:48:15 +01:00
2024-07-05 09:34:04 +02:00
2023-05-25 09:26:19 +02:00
2023-04-17 18:01:23 +02:00
2023-01-19 16:07:40 +01:00
2023-03-06 15:49:07 -06:00
2024-03-26 18:20:13 -04:00
2023-01-29 15:18:33 -07:00
2023-01-29 15:18:33 -07:00
2024-12-14 19:59:58 +01:00
2024-08-29 17:33:31 +02:00
2023-03-19 10:02:04 -07:00
2023-06-13 16:49:23 +02:00
2023-05-01 17:50:18 -07:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2025-07-06 11:00:16 +02:00
2022-07-17 17:31:38 -07:00
2022-10-03 14:03:19 -07:00
2024-06-16 13:47:41 +02:00
2024-06-12 11:12:52 +02:00
2023-08-15 14:57:25 -07:00
2022-07-27 14:04:52 +02:00
2023-01-19 09:24:30 +01:00
2022-08-02 12:34:04 -04:00
2023-06-20 20:17:10 -07:00
2025-02-08 09:52:02 +01:00
2025-01-09 13:31:41 +01:00
2024-04-03 15:28:29 +02:00
2022-09-26 19:46:27 -07:00
2023-08-18 10:12:25 -07:00
2023-06-23 16:59:30 -07:00
2023-06-05 09:36:39 +02:00
2023-07-18 10:07:47 +02:00
2025-04-25 10:45:31 +02:00
2023-03-06 09:57:07 +01:00
2025-08-15 12:08:42 +02:00
2022-12-20 03:13:45 +01:00
2023-08-12 09:18:47 -07:00
2024-06-12 11:11:56 +02:00
2025-01-23 17:21:12 +01:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-05-23 12:55:12 -07:00
2024-05-17 12:01:59 +02:00
2023-07-15 11:34:49 -07:00
2025-01-09 13:31:41 +01:00
2025-02-01 18:37:51 +01:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2023-06-11 18:22:47 +02:00
2025-02-27 04:10:50 -08:00
2024-08-29 17:33:23 +02:00
2023-06-05 09:36:39 +02:00
2023-11-28 17:19:38 +00:00
2025-08-01 09:47:30 +01:00
2022-09-07 12:42:25 +01:00
2023-08-21 13:37:26 -07:00
2022-09-29 15:20:29 +02:00
2024-10-17 15:24:23 +02:00
2025-05-22 14:12:12 +02:00
2023-08-11 21:12:47 +02:00
2023-03-16 13:08:39 -07:00
2024-11-08 16:28:26 +01:00
2022-08-28 16:52:28 +01:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-04-21 03:02:34 -04:00
2023-08-21 14:52:16 +02:00
2022-10-24 12:12:32 -07:00
2023-08-21 13:37:27 -07:00