Re: [PATCH net v2] calipso: update payload_len when removing the CALIPSO option
flat view
From: sashiko-bot@kernel.org
Date: 2026-10-09 15:28:27
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] ipv6: calipso_skbuff_delattr corrupts MAC header on bridged packets -- commit 9797bee2d14350b4afedb726df3172b004b7badd Author: Joas Antonio dos Santos [off-list ref] calipso: update payload_len when removing the CALIPSO option This commit updates calipso_skbuff_delattr() to adjust the IPv6 payload length after removing a CALIPSO option. The patch prevents forwarded packets from being dropped as truncated by subtracting the removed length, while leaving BIG TCP packets unchanged.
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index c6a34334e657e..5a42db4f87472 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c@@ -1428,6 +1428,10 @@ static int calipso_skbuff_delattr(struct sk_buff *skb) skb_pull(skb, delta); memmove((char *)ip6_hdr + delta, ip6_hdr, size); skb_reset_network_header(skb);
[Severity: High] When a bridged IPv6 packet with a CALIPSO option is forwarded, br_netfilter feeds it to the NF_INET_FORWARD hook where SELinux may call calipso_skbuff_delattr() in net/ipv6/calipso.c. Does shifting the IPv6 header forward by delta bytes here without repositioning the MAC header create a gap that corrupts the MAC header on bridged packets? Because bridged packets bypass L3 routing and do not go through neigh_output(), the bridge's transmission function br_dev_queue_push_xmit() unconditionally calls skb_push(skb, ETH_HLEN). Since skb->data is shifted by delta bytes during the pull, this incorrectly frames the transmitted MAC header starting delta bytes into the original MAC header. Could this result in the transmission of gap bytes and the loss of the destination MAC address, causing severe packet corruption and drops on L2 forwarded packets?
quoted hunk ↗ jump to hunk
+ ip6_hdr = ipv6_hdr(skb); + /* BIG TCP packets have payload_len == 0 */ + if (ip6_hdr->payload_len) + be16_add_cpu(&ip6_hdr->payload_len, -delta); } return 0;
-- Sashiko AI review · https://sashiko.dev/#/patchset/179147329205.58079.5847298721173675285@gmail.com?part=1