Re: [PATCH net] ipv6: fix out-of-bound access in ip6_parse_tlv()

On Wed, 23 Jun 2021 12:43:53 -0700 Eric Dumazet wrote:

From: Eric Dumazet <edumazet@google.com>

First problem is that optlen is fetched without checking
there is more than one byte to parse.

Fix this by taking care of IPV6_TLV_PAD1 before
fetching optlen (under appropriate sanity checks against len)

Second problem is that IPV6_TLV_PADN checks of zero
padding are performed before the check of remaining length.

Fixes: c1412fce7ecc ("net/ipv6/exthdrs.c: Strict PadN option checking")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Tom Herbert <redacted>
---

Only compiled, I would appreciate a solid review of this patch before merging it, thanks !

Reviewed-by: Jakub Kicinski <kuba@kernel.org>

for what that's worth