Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:
On Wed, 16 Sep 2026 21:57:53 +0200 you wrote:
> ipv6_find_hdr() walks the extension header chain, skipping each header by
> the length that header itself declares. ipv6_optlen() returns up to 2048,
> and the skip is never checked against skb->len, so the offset stored in
> *offset can point past the end of the packet.
>
> openvswitch installs that offset as the transport header, and
> update_ipv6_checksum() then reads and writes the transport checksum field
> out of bounds:
>
> [...]
Here is the summary with links:
- [net,v2] ipv6: do not let ipv6_find_hdr() return an offset past the packet
end
https://git.kernel.org/netdev/net/c/ee319bd3a0e9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
