Patch "netfilter: xt_length: use skb len to match in length_mt6" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: xt_length: use skb len to match in length_mt6

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-xt_length-use-skb-len-to-match-in-length_m.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7808e5221c4a060b6e8399976977499a9ae5e295
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Fri Feb 17 18:22:57 2023 -0500

    netfilter: xt_length: use skb len to match in length_mt6
    
    [ Upstream commit 05c07c0c6cc8ec2278ace9871618c41f1365d1f5 ]
    
    For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0,
    and its real payload_len ( > 65535) is saved in hbh exthdr. With 0
    length for the jumbo packets, it may mismatch.
    
    To fix this, we can just use skb->len instead of parsing exthdrs, as
    the hbh exthdr parsing has been done before coming to length_mt6 in
    ip6_rcv_core() and br_validate_ipv6() and also the packet has been
    trimmed according to the correct IPv6 (ext)hdr length there, and skb
    len is trustable in length_mt6().
    
    Note that this patch is especially needed after the IPv6 BIG TCP was
    supported in kernel, which is using IPv6 Jumbo packets. Besides, to
    match the packets greater than 65535 more properly, a v1 revision of
    xt_length may be needed to extend "min, max" to u32 in the future,
    and for now the IPv6 Jumbo packets can be matched by:
    
      # ip6tables -m length ! --length 0:65535
    
    Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
    Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/xt_length.c b/net/netfilter/xt_length.c
index 1873da3a945ab..9fbfad13176f0 100644
--- a/net/netfilter/xt_length.c
+++ b/net/netfilter/xt_length.c
@@ -30,8 +30,7 @@ static bool
 length_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct xt_length_info *info = par->matchinfo;
-	const u_int16_t pktlen = ntohs(ipv6_hdr(skb)->payload_len) +
-				 sizeof(struct ipv6hdr);
+	u32 pktlen = skb->len;
 
 	return (pktlen >= info->min && pktlen <= info->max) ^ info->invert;
 }