Re: [PATCH] ipv6: calipso: fix 8-bit hdrlen overflow and missing pskb_may_pull() in hop-by-hop options

Two bugs exist in the CALIPSO hop-by-hop option handling in
net/ipv6/calipso.c:

1. When inserting a CALIPSO option into an existing Hop-by-Hop extension
   header in calipso_opt_insert() or calipso_skbuff_setattr(), the
   resulting header length `buf_len` (or `ipv6_optlen(hop) + len_delta`)
   can exceed the maximum size representable by the 8-bit `hdrlen` field
   (256 * 8 = 2048 bytes). When `buf_len > 2048`, `new->hdrlen = buf_len
   / 8 - 1` (or `hop->hdrlen = ...`) truncates modulo 256, causing
   `ipv6_optlen()` to under-report the allocated header size and
   mismatch `opt->opt_nflen` or `skb->len`.
2. In calipso_skbuff_setattr(), when `ip6_hdr->nexthdr == NEXTHDR_HOP`,
   `hop` is dereferenced at `(struct ipv6_opt_hdr *)(ip6_hdr + 1)` and
   scanned by `calipso_opt_find(hop, &start, &end)` without ensuring
   that the Hop-by-Hop header resides in the linear data area of `skb`
   via `pskb_may_pull()`, risking an out-of-bounds read past `skb->tail`
   on non-linear skbs.

Reject Hop-by-Hop headers that would exceed `8 * 256` bytes with
`-ENOSPC`, and ensure `pskb_may_pull()` linearizes `hop` before
inspecting it in calipso_skbuff_setattr().

Fixes: ceba1832b1b2 ("calipso: Set the calipso socket label to match the secattr.")
Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919210621.3029744-1-benquike@gmail.com?part=1