| Message ID | 20240415222041.18537-6-kuniyu@amazon.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ip: Fix warning in pskb_may_pull_reason() for tunnel devices. | expand |
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index e9cc315832cb..81be7a5be6c5 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1424,14 +1424,17 @@ ip6_tnl_start_xmit(struct sk_buff *skb, struct net_device *dev) u8 ipproto; int ret; - if (!pskb_inet_may_pull(skb)) - goto tx_err; - switch (skb->protocol) { case htons(ETH_P_IP): + if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) + goto tx_err; + ipproto = IPPROTO_IPIP; break; case htons(ETH_P_IPV6): + if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) + goto tx_err; + if (ip6_tnl_addr_conflict(t, ipv6_hdr(skb))) goto tx_err; ipproto = IPPROTO_IPV6;
syzkaller demonstrated the underflow in pskb_network_may_pull() by sending a crafted VLAN packet over tunnel devices: sit, ipip, vti, and vti6. The same warning will be triggered for ip6tnl, so let's check skb->protocol before pulling the next header in ip6_tnl_start_xmit(). Fixes: cb9f1b783850 ("ip: validate header length on virtual device xmit") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> --- net/ipv6/ip6_tunnel.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)