* [PATCH v2] net/sched: act_pedit: require matching IPv4 L4 protocol
@ 2026-06-07 19:35 Samuel Moelius
2026-06-09 2:18 ` Jakub Kicinski
0 siblings, 1 reply; 2+ messages in thread
From: Samuel Moelius @ 2026-06-07 19:35 UTC (permalink / raw)
To: Jamal Hadi Salim
Cc: Samuel Moelius, Jiri Pirko, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, open list:TC subsystem,
open list
The extended IPv4 L4 header mode in act_pedit can select TCP or UDP
header fields without confirming that the IPv4 protocol field matches
the selected transport header.
That lets a rule written for TCP or UDP modify unrelated payload bytes
in a packet carrying a different protocol.
Verify that the IPv4 header is long enough, that the protocol matches
the selected TCP or UDP header, and that the packet is not a non-initial
fragment before applying TCP or UDP extended header edits.
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits•com>
---
Changes in v2
- Add check of iph->frag_off & htons(IP_OFFSET)
net/sched/act_pedit.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index bc20f08a2789..2730accbc56a 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -17,6 +17,7 @@
#include <linux/ipv6.h>
#include <linux/slab.h>
#include <net/ipv6.h>
+#include <net/ip.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <linux/tc_act/tc_pedit.h>
@@ -341,6 +342,9 @@ static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int head
if (!iph)
goto out;
+ if (iph->ihl < 5 || iph->protocol != header_type ||
+ (iph->frag_off & htons(IP_OFFSET)))
+ goto out;
*hoffset = noff + iph->ihl * 4;
ret = 0;
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] net/sched: act_pedit: require matching IPv4 L4 protocol
2026-06-07 19:35 [PATCH v2] net/sched: act_pedit: require matching IPv4 L4 protocol Samuel Moelius
@ 2026-06-09 2:18 ` Jakub Kicinski
0 siblings, 0 replies; 2+ messages in thread
From: Jakub Kicinski @ 2026-06-09 2:18 UTC (permalink / raw)
To: Samuel Moelius
Cc: Jamal Hadi Salim, Jiri Pirko, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, open list:TC subsystem, open list
On Sun, 7 Jun 2026 19:35:46 +0000 Samuel Moelius wrote:
> The extended IPv4 L4 header mode in act_pedit can select TCP or UDP
> header fields without confirming that the IPv4 protocol field matches
> the selected transport header.
>
> That lets a rule written for TCP or UDP modify unrelated payload bytes
> in a packet carrying a different protocol.
>
> Verify that the IPv4 header is long enough, that the protocol matches
> the selected TCP or UDP header, and that the packet is not a non-initial
> fragment before applying TCP or UDP extended header edits.
This is a hardening patch?
It doesn't apply to either networking tree cleanly, please rebase on
net (if it's a fix) and net-next (if it's hardening) and repost
--
pw-bot: cr
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-09 2:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-07 19:35 [PATCH v2] net/sched: act_pedit: require matching IPv4 L4 protocol Samuel Moelius
2026-06-09 2:18 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox