public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

* [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto()
@ 2026-06-08 17:06 Lorenzo Bianconi
  2026-06-08 23:11 ` Pablo Neira Ayuso
  0 siblings, 1 reply; 3+ messages in thread
From: Lorenzo Bianconi @ 2026-06-08 17:06 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, David S. Miller,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman
  Cc: netfilter-devel, coreteam, netdev, Lorenzo Bianconi

Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to
pskb_may_pull() for header validation, aligning it with the approach
used in nf_flow_ip4_tunnel_proto().
Move ctx->offset update inside the IPPROTO_IPV6 conditional block since
it should only be adjusted when a tunnel is actually detected.
While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant
when setting ctx->tun.proto.

Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel•org>
---
 net/netfilter/nf_flow_table_ip.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 9c05a50d6013..2946399ab715 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
 				     struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_IPV6)
-	struct ipv6hdr *ip6h, _ip6h;
+	struct ipv6hdr *ip6h;
 	__be16 frag_off;
 	u8 nexthdr;
 	int hdrlen;
 
-	ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
-	if (!ip6h)
+	if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
 		return false;
 
+	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
 	if (ip6h->hop_limit <= 1)
 		return false;
 
@@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
 
 	if (nexthdr == IPPROTO_IPV6) {
 		ctx->tun.hdr_size = hdrlen;
-		ctx->tun.proto = IPPROTO_IPV6;
+		ctx->tun.proto = nexthdr;
+		ctx->offset += ctx->tun.hdr_size;
 	}
-	ctx->offset += ctx->tun.hdr_size;
 
 	return true;
 #else

---
base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4

Best regards,
-- 
Lorenzo Bianconi <lorenzo@kernel•org>


^ permalink raw reply related	[flat|nested] 3+ messages in thread

• * Re: [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto()
    2026-06-08 17:06 [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto() Lorenzo Bianconi
  @ 2026-06-08 23:11 ` Pablo Neira Ayuso
    2026-06-09 10:28   ` Lorenzo Bianconi
    0 siblings, 1 reply; 3+ messages in thread
  From: Pablo Neira Ayuso @ 2026-06-08 23:11 UTC (permalink / raw)
    To: Lorenzo Bianconi
    Cc: Florian Westphal, Phil Sutter, David S. Miller, Eric Dumazet,
  	Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel,
  	coreteam, netdev
  
  Hi Lorenzo,
  
  On Mon, Jun 08, 2026 at 07:06:52PM +0200, Lorenzo Bianconi wrote:
  > Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to
  > pskb_may_pull() for header validation, aligning it with the approach
  > used in nf_flow_ip4_tunnel_proto().
  > Move ctx->offset update inside the IPPROTO_IPV6 conditional block since
  > it should only be adjusted when a tunnel is actually detected.
  > While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant
  > when setting ctx->tun.proto.
  > 
  > Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
  > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel•org>
  > ---
  >  net/netfilter/nf_flow_table_ip.c | 10 +++++-----
  >  1 file changed, 5 insertions(+), 5 deletions(-)
  > 
  > diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
  > index 9c05a50d6013..2946399ab715 100644
  > --- a/net/netfilter/nf_flow_table_ip.c
  > +++ b/net/netfilter/nf_flow_table_ip.c
  > @@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
  >  				     struct sk_buff *skb)
  >  {
  >  #if IS_ENABLED(CONFIG_IPV6)
  > -	struct ipv6hdr *ip6h, _ip6h;
  > +	struct ipv6hdr *ip6h;
  >  	__be16 frag_off;
  >  	u8 nexthdr;
  >  	int hdrlen;
  >  
  > -	ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
  > -	if (!ip6h)
  > +	if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
  >  		return false;
  >  
  > +	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
  >  	if (ip6h->hop_limit <= 1)
  >  		return false;
  
  Not shown in the patch, but is there still a corner case here that
  needs to be covered?
  
  ipv6_skip_exthdr() uses skb_header_pointer() internal, then another
  pskb_may_pull() is needed to make sure no other IPv6 extension header
  sits between the outer and the inner IPPROTO_IPV6 header, allowing to
  be in a non-linear area of the skb?        
  
  > @@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
  >  
  
  I mean:
  
          if (!pskb_may_pull(skb, hdrlen))
                  return false;
  
  where hdrlen is what ipv6_skip_exthdr() returns.
  
  Then, I think it should be safe to call skb_pull() on
  ctx->tun.hdr_size.
  
  Let me know, thanks.
  
  >  	if (nexthdr == IPPROTO_IPV6) {
  >  		ctx->tun.hdr_size = hdrlen;
  > -		ctx->tun.proto = IPPROTO_IPV6;
  > +		ctx->tun.proto = nexthdr;
  > +		ctx->offset += ctx->tun.hdr_size;
  >  	}
  > -	ctx->offset += ctx->tun.hdr_size;
  >  
  >  	return true;
  >  #else
  > 
  > ---
  > base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
  > change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4
  > 
  > Best regards,
  > -- 
  > Lorenzo Bianconi <lorenzo@kernel•org>
  > 
  
  ^ permalink raw reply	[flat|nested] 3+ messages in thread

• • * Re: [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto()
      2026-06-08 23:11 ` Pablo Neira Ayuso
    @ 2026-06-09 10:28   ` Lorenzo Bianconi
      0 siblings, 0 replies; 3+ messages in thread
    From: Lorenzo Bianconi @ 2026-06-09 10:28 UTC (permalink / raw)
      To: Pablo Neira Ayuso
      Cc: Florian Westphal, Phil Sutter, David S. Miller, Eric Dumazet,
    	Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel,
    	coreteam, netdev
    
    [-- Attachment #1: Type: text/plain, Size: 3241 bytes --]
    
    On Jun 09, Pablo Neira Ayuso wrote:
    > Hi Lorenzo,
    > 
    > On Mon, Jun 08, 2026 at 07:06:52PM +0200, Lorenzo Bianconi wrote:
    > > Switch nf_flow_ip6_tunnel_proto() from skb_header_pointer() to
    > > pskb_may_pull() for header validation, aligning it with the approach
    > > used in nf_flow_ip4_tunnel_proto().
    > > Move ctx->offset update inside the IPPROTO_IPV6 conditional block since
    > > it should only be adjusted when a tunnel is actually detected.
    > > While at it, use nexthdr instead of the hardcoded IPPROTO_IPV6 constant
    > > when setting ctx->tun.proto.
    > > 
    > > Fixes: d98103575dcdd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
    > > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel•org>
    > > ---
    > >  net/netfilter/nf_flow_table_ip.c | 10 +++++-----
    > >  1 file changed, 5 insertions(+), 5 deletions(-)
    > > 
    > > diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
    > > index 9c05a50d6013..2946399ab715 100644
    > > --- a/net/netfilter/nf_flow_table_ip.c
    > > +++ b/net/netfilter/nf_flow_table_ip.c
    > > @@ -347,15 +347,15 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
    > >  				     struct sk_buff *skb)
    > >  {
    > >  #if IS_ENABLED(CONFIG_IPV6)
    > > -	struct ipv6hdr *ip6h, _ip6h;
    > > +	struct ipv6hdr *ip6h;
    > >  	__be16 frag_off;
    > >  	u8 nexthdr;
    > >  	int hdrlen;
    > >  
    > > -	ip6h = skb_header_pointer(skb, ctx->offset, sizeof(*ip6h), &_ip6h);
    > > -	if (!ip6h)
    > > +	if (!pskb_may_pull(skb, sizeof(*ip6h) + ctx->offset))
    > >  		return false;
    > >  
    > > +	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset);
    > >  	if (ip6h->hop_limit <= 1)
    > >  		return false;
    > 
    > Not shown in the patch, but is there still a corner case here that
    > needs to be covered?
    > 
    > ipv6_skip_exthdr() uses skb_header_pointer() internal, then another
    > pskb_may_pull() is needed to make sure no other IPv6 extension header
    > sits between the outer and the inner IPPROTO_IPV6 header, allowing to
    > be in a non-linear area of the skb?        
    > 
    > > @@ -367,9 +367,9 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx,
    > >  
    > 
    > I mean:
    > 
    >         if (!pskb_may_pull(skb, hdrlen))
    >                 return false;
    > 
    > where hdrlen is what ipv6_skip_exthdr() returns.
    > 
    > Then, I think it should be safe to call skb_pull() on
    > ctx->tun.hdr_size.
    > 
    > Let me know, thanks.
    
    I think you are right, here we need to run:
    
    	if (!pskb_may_pull(skb, hdrlen))
    		return false;
    
    in order to be sure we can pull ctx->tun.hdr_size in nf_flow_ip_tunnel_pop().
    Doing so, we can roll-back to the original skb_header_pointer() to access the
    outer ip6 header here. What do you think?
    
    Regards,
    Lorenzo
    
    > 
    > >  	if (nexthdr == IPPROTO_IPV6) {
    > >  		ctx->tun.hdr_size = hdrlen;
    > > -		ctx->tun.proto = IPPROTO_IPV6;
    > > +		ctx->tun.proto = nexthdr;
    > > +		ctx->offset += ctx->tun.hdr_size;
    > >  	}
    > > -	ctx->offset += ctx->tun.hdr_size;
    > >  
    > >  	return true;
    > >  #else
    > > 
    > > ---
    > > base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
    > > change-id: 20260608-b4-nf_flow_ip6_tunnel_proto-update-8b64903825b4
    > > 
    > > Best regards,
    > > -- 
    > > Lorenzo Bianconi <lorenzo@kernel•org>
    > > 
    
    [-- Attachment #2: signature.asc --]
    [-- Type: application/pgp-signature, Size: 228 bytes --]
    
    ^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2026-06-09 10:28 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-08 17:06 [PATCH nf] netfilter: flowtable: use pskb_may_pull() in nf_flow_ip6_tunnel_proto() Lorenzo Bianconi
2026-06-08 23:11 ` Pablo Neira Ayuso
2026-06-09 10:28   ` Lorenzo Bianconi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox