Hi Esteban,
On 08/08/2026 04:09, Esteban Alba via B4 Relay wrote:
> From: Esteban Alba <[email protected]>
>
> net_ip6_handler() checks the received length only against IP6_HDR_SIZE
> and then uses two length fields from the packet without checking them.
> The checksum is computed over payload_len, but the length passed to the
> UDP handler comes from udp_len. A sender can keep payload_len correct so
> the checksum still validates and set udp_len larger than the frame. A
> handler that trusts that length then reads or writes past the receive
> buffer. The DHCPv6 client copies the declared number of bytes and can be
> made to write past the packet buffer from a single link-local ADVERTISE.
>
> The IPv4 path already reconciles these lengths in
> net_process_received_packet(). Do the same here: reject a payload_len
> that exceeds the received length and trim len to it, then reject a
> udp_len smaller than the UDP header or larger than the payload before
> calling the handler.
>
> Fixes: 1feb697830ce ("net: ipv6: Add implementation of main IPv6 functions")
> Signed-off-by: Esteban Alba <[email protected]>
> Cc: Jerome Forissier <[email protected]>
> Cc: Tom Rini <[email protected]>
> ---
> net/net6.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/net/net6.c b/net/net6.c
> index 4cff98df15..af2f484fad 100644
> --- a/net/net6.c
> +++ b/net/net6.c
> @@ -392,6 +392,11 @@ int net_ip6_handler(struct ethernet_hdr *et, struct
> ip6_hdr *ip6, int len)
> if (ip6->version != 6)
> return -EINVAL;
>
> + /* Trim to the length declared in the header, as the IPv4 path does */
> + if (len < IP6_HDR_SIZE + ntohs(ip6->payload_len))
> + return -EINVAL;
> + len = IP6_HDR_SIZE + ntohs(ip6->payload_len);
> +
> switch (ip6->nexthdr) {
> case PROT_ICMPV6:
> icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
> @@ -433,6 +438,10 @@ int net_ip6_handler(struct ethernet_hdr *et, struct
> ip6_hdr *ip6, int len)
> if (csum != udp->udp_xsum)
> return -EINVAL;
>
> + if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
> + ntohs(udp->udp_len) > len - IP6_HDR_SIZE)
> + return -EINVAL;
> +
> /* IP header OK. Pass the packet to the current handler. */
> net_get_udp_handler()((uchar *)ip6 + IP6_HDR_SIZE +
> UDP_HDR_SIZE,
>
I still see a couple of issues in this code. In the UDP path, udp->udp_xsum
is accessed before checking that payload_len >= UDP_HDR_SIZE, so a short IPv6
payload can still cause an out-of-bounds access. The ICMPv6 path has the
same issue when accessing struct icmp6hdr.
The transport header size therefore needs to be validated before either
header is dereferenced. The UDP length checks should also be done before
accessing the UDP checksum field.
Something along the following lines:
--- a/net/net6.c
+++ b/net/net6.c
@@ -370,11 +370,19 @@ int net_ip6_handler(struct ethernet_hdr *et, struct
ip6_hdr *ip6, int len)
if (ip6->version != 6)
return -EINVAL;
+ hlen = ntohs(ip6->payload_len);
+
+ /* Trim to the length declared in the header, as the IPv4 path does */
+ if (len < IP6_HDR_SIZE + hlen)
+ return -EINVAL;
+ len = IP6_HDR_SIZE + hlen;
+
switch (ip6->nexthdr) {
case PROT_ICMPV6:
+ if (hlen < sizeof(struct icmp6hdr))
+ return -EINVAL;
+
icmp = (struct icmp6hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
csum = icmp->icmp6_cksum;
- hlen = ntohs(ip6->payload_len);
icmp->icmp6_cksum = 0;
/* checksum */
csum_p = csum_partial((u8 *)icmp, hlen, 0);
@@ -398,9 +406,15 @@ int net_ip6_handler(struct ethernet_hdr *et, struct
ip6_hdr *ip6, int len)
}
break;
case IPPROTO_UDP:
+ if (hlen < UDP_HDR_SIZE)
+ return -EINVAL;
+
udp = (struct udp_hdr *)(((uchar *)ip6) + IP6_HDR_SIZE);
+ if (ntohs(udp->udp_len) < UDP_HDR_SIZE ||
+ ntohs(udp->udp_len) > hlen)
+ return -EINVAL;
+
csum = udp->udp_xsum;
- hlen = ntohs(ip6->payload_len);
udp->udp_xsum = 0;
/* checksum */
csum_p = csum_partial((u8 *)udp, hlen, 0);
Thanks,
--
Jerome
> ---
> base-commit: ece349ade2973e220f524ce59e59711cc919263f
> change-id: 20260807-net6-len-validation-cd71efd96a7f
>
> Best regards,
> --
> Esteban Alba <[email protected]>
>
>
