On 2 Nov 2026, at 2:45, Joas Antonio dos Santos via B4 Relay wrote:
> From: Joas Antonio dos Santos <[email protected]>
>
> get_ipv6_ext_hdrs() walks the IPv6 extension header chain to fill
> key->ipv6.exthdrs, but advances to the next header with ipv6_optlen()
> whatever the current header is. That is only right for Hop-by-Hop,
> Destination Options and Routing headers:
>
> - an Authentication Header is ((hdrlen + 2) << 2) bytes long
> (ipv6_authlen()), so with hdrlen = 4 the walk skips 40 bytes instead
> of 24 and reads the next "header" from the ICV and payload;
>
> - a Fragment header is always 8 bytes, and the byte read as hdrlen is
> its Reserved field, which the sender controls and receivers ignore,
> so a non-zero value makes the walk skip up to 2048 bytes and miss
> the headers that follow;
>
> - in a non-first fragment nothing after the Fragment header is a
> header at all, it is the middle of the fragmentable part, yet the
> walk keeps parsing it as an extension header chain.
>
> In all cases the OFPIEH12_* bits stored in key->ipv6.exthdrs depend on
> bytes chosen by the sender rather than on the headers that are actually
> present: payload bytes that look like another AH or a Hop-by-Hop header
> add OFPIEH12_UNREP/OFPIEH12_UNSEQ, and real headers after a Fragment
> header can go unreported. Flows that match on OVS_KEY_ATTR_IPV6_EXTHDRS
> then classify such packets wrongly. There is no memory safety issue,
> skb_header_pointer() bounds every read.
>
> Advance by sizeof(struct frag_hdr) for Fragment headers and by
> ipv6_authlen() for AH, and stop at the Fragment header if its offset is
> non-zero, as ipv6_find_hdr() does.
>
> Fixes: 28a3f0601727 ("net: openvswitch: IPv6: Add IPv6 extension header
> support")
> Link:
> https://lore.kernel.org/all/[email protected]/
> Cc: [email protected]
> Signed-off-by: Joas Antonio dos Santos <[email protected]>
Thanks the patch looks good to me.
Reviewed-by: Eelco Chaudron <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
