* [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto()
@ 2026-06-08 17:06 Lorenzo Bianconi
2026-06-08 23:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Lorenzo Bianconi @ 2026-06-08 17:06 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman
Cc: netfilter-devel, coreteam, netdev, Lorenzo Bianconi
Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to
pskb_may_pull() for header validation, aligning it with the approach
used in nf_flow_ip4_tunnel_proto().
Move ctx->offset update inside the IPPROTO_IPV6 conditional block since
it should only be adjusted when a tunnel is actually detected.
While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant
when setting ctx->tun.proto.
Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel•org>
---
net/netfilter/nf_flow_table_ip.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 9c05a50d6013..2946399ab715 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
struct sk_buff *skb)
{
#if IS_ENABLED(CONFIG_IPV6)
- struct ipv6hdr *ip6h, _ip6h;
+ struct ipv6hdr *ip6h;
__be16 frag_off;
u8 nexthdr;
int hdrlen;
- ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
- if (!ip6h)
+ if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
return false;
+ ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
if (ip6h->hop_limit <= 1)
return false;
@@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
if (nexthdr == IPPROTO_IPV6) {
ctx->tun.hdr_size = hdrlen;
- ctx->tun.proto = IPPROTO_IPV6;
+ ctx->tun.proto = nexthdr;
+ ctx->offset += ctx->tun.hdr_size;
}
- ctx->offset += ctx->tun.hdr_size;
return true;
#else
---
base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4
Best regards,
--
Lorenzo Bianconi <lorenzo@kernel•org>
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto()
2026-06-08 17:06 [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto() Lorenzo Bianconi
@ 2026-06-08 23:11 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2026-06-08 23:11 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: Florian Westphal, Phil Sutter, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel,
coreteam, netdev
Hi Lorenzo,
On Mon, Jun 08, 2026 at 07:06:52PM +0200, Lorenzo Bianconi wrote:
> Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to
> pskb_may_pull() for header validation, aligning it with the approach
> used in nf_flow_ip4_tunnel_proto().
> Move ctx->offset update inside the IPPROTO_IPV6 conditional block since
> it should only be adjusted when a tunnel is actually detected.
> While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant
> when setting ctx->tun.proto.
>
> Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel•org>
> ---
> net/netfilter/nf_flow_table_ip.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index 9c05a50d6013..2946399ab715 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
> struct sk_buff *skb)
> {
> #if IS_ENABLED(CONFIG_IPV6)
> - struct ipv6hdr *ip6h, _ip6h;
> + struct ipv6hdr *ip6h;
> __be16 frag_off;
> u8 nexthdr;
> int hdrlen;
>
> - ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
> - if (!ip6h)
> + if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
> return false;
>
> + ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
> if (ip6h->hop_limit <= 1)
> return false;
Not shown in the patch, but is there still a corner case here that
needs to be covered?
ipv6_skip_exthdr() uses skb_header_pointer() internal, then another
pskb_may_pull() is needed to make sure no other IPv6 extension header
sits between the outer and the inner IPPROTO_IPV6 header, allowing to
be in a non-linear area of the skb?
> @@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
>
I mean:
if (!pskb_may_pull(skb, hdrlen))
return false;
where hdrlen is what ipv6_skip_exthdr() returns.
Then, I think it should be safe to call skb_pull() on
ctx->tun.hdr_size.
Let me know, thanks.
> if (nexthdr == IPPROTO_IPV6) {
> ctx->tun.hdr_size = hdrlen;
> - ctx->tun.proto = IPPROTO_IPV6;
> + ctx->tun.proto = nexthdr;
> + ctx->offset += ctx->tun.hdr_size;
> }
> - ctx->offset += ctx->tun.hdr_size;
>
> return true;
> #else
>
> ---
> base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
> change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4
>
> Best regards,
> --
> Lorenzo Bianconi <lorenzo@kernel•org>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-08 23:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-08 17:06 [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto() Lorenzo Bianconi
2026-06-08 23:11 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox