Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
To:     "David S. Miller" <davem@davemloft.net>
CC:     David Ahern <dsahern@kernel.org>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        "Vlad Yasevich" <vyasevic@redhat.com>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: [PATCH net] ipv6: Fix out-of-bounds access in ipv6_find_tlv()
Thread-Topic: [PATCH net] ipv6: Fix out-of-bounds access in ipv6_find_tlv()
Thread-Index: AQHZjVC60BCTLkGAM0GRT+QNTyB9AA==
Date:   Tue, 23 May 2023 08:29:44 +0000
Message-ID: <20230523082903.117626-1-Ilia.Gavrilov@infotecs.ru>
Accept-Language: ru-RU, en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Precedence: bulk

optlen is fetched without checking whether there is more than one byte to p=
arse.
It can lead to out-of-bounds access.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed fu=
nctions")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
---
 net/ipv6/exthdrs_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index da46c4284676..49e31e4ae7b7 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset=
, int type)
 			optlen =3D 1;
 			break;
 		default:
+			if (len < 2)
+				goto bad;
 			optlen =3D nh[offset + 1] + 2;
 			if (optlen > len)
 				goto bad;
--=20
2.30.2