> ip_do_fragment() and nf_br_ip_fragment() complete a CHECKSUM_PARTIAL skb
> before reading the IPv4 header length. ip6_fragment() and br_ip6_fragment()
> complete one after parsing the IPv6 header chain. A virtualization
> interface can supply a checksum start which, after link-layer removal,
> still points inside that parsed network header.
>
> skb_checksum_help() then writes the completed checksum into header bytes
> the stack has already consumed. For IPv4, changing iph->ihl after routing
> and validation can make fragmentation copy beyond the skb's logical linear
> head into transmitted options. A negative checksum-start offset is rejected
> by skb_checksum_help(), but only after a WARN_ONCE which can panic a
> panic_on_warn system.
>
> Validate the checksum start against the parsed header length before
> completing it. For IPv4, read and validate IHL first, retain it, and
> reacquire iph after skb_checksum_help() in both implementations. For IPv6,
> use the length returned by ip6_find_1stfragopt() in both implementations.
>
> Compare the signed checksum-start offset with the bounded signed header
> length so integer promotion cannot bypass either boundary.
>
> Fixes: dbd3393c56a8 ("ipv4: add defensive check for CHECKSUM_PARTIAL skbs in
> ip_fragment")
> Fixes: 405c92f7a541 ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in
> ip_fragment")
> Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
> Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
> Reported-by: Paulos Yibelo <[email protected]>
> Link:
> https://lore.kernel.org/netdev/[email protected]/
> Cc: [email protected]
> Signed-off-by: Paulos Yibelo <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=2
