Patch "esp6: fix check on ipv6_skip_exthdr's return value" has been added to the 5.16-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    esp6: fix check on ipv6_skip_exthdr's return value

to the 5.16-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     esp6-fix-check-on-ipv6_skip_exthdr-s-return-value.patch
and it can be found in the queue-5.16 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 724c60c2856390c82e9daaa1ecea7e4bee6644f7
Author: Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
Date:   Thu Mar 10 11:49:00 2022 +0100

    esp6: fix check on ipv6_skip_exthdr's return value
    
    [ Upstream commit 4db4075f92af2b28f415fc979ab626e6b37d67b6 ]
    
    Commit 5f9c55c8066b ("ipv6: check return value of ipv6_skip_exthdr")
    introduced an incorrect check, which leads to all ESP packets over
    either TCPv6 or UDPv6 encapsulation being dropped. In this particular
    case, offset is negative, since skb->data points to the ESP header in
    the following chain of headers, while skb->network_header points to
    the IPv6 header:
    
        IPv6 | ext | ... | ext | UDP | ESP | ...
    
    That doesn't seem to be a problem, especially considering that if we
    reach esp6_input_done2, we're guaranteed to have a full set of headers
    available (otherwise the packet would have been dropped earlier in the
    stack). However, it means that the return value will (intentionally)
    be negative. We can make the test more specific, as the expected
    return value of ipv6_skip_exthdr will be the (negated) size of either
    a UDP header, or a TCP header with possible options.
    
    In the future, we should probably either make ipv6_skip_exthdr
    explicitly accept negative offsets (and adjust its return value for
    error cases), or make ipv6_skip_exthdr only take non-negative
    offsets (and audit all callers).
    
    Fixes: 5f9c55c8066b ("ipv6: check return value of ipv6_skip_exthdr")
    Reported-by: Xiumei Mu <xmu@xxxxxxxxxx>
    Signed-off-by: Sabrina Dubroca <sd@xxxxxxxxxxxxxxx>
    Signed-off-by: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b7b573085bd5..5023f59a5b96 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -813,8 +813,7 @@ int esp6_input_done2(struct sk_buff *skb, int err)
 		struct tcphdr *th;
 
 		offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
-
-		if (offset < 0) {
+		if (offset == -1) {
 			err = -EINVAL;
 			goto out;
 		}