Re: [PATCH net] openvswitch: reject a negative transport length in the IPv6 L4 checksum update

On Sep 15, 2026, at 23:40, Eric Dumazet [off-list ref] wrote:

On Tue, Sep 15, 2026 at 2:13 PM Ilya Maximets [off-list ref] wrote:

quoted

Hi, Norbert.

This looks like something that needs to be fixed in the ipv6_find_hdr().
IMO, this function should not return an offset that doesn't exist in the
packet, i.e. we should not be able to find what's not in there.

CC: David and Ido.

In general, we should be able to trust the skb_transport_offset(),
otherwise there could be other issues all over the place, not only in
openvswitch.

Totally agree.
We keep receiving defensive code instead of finding and fixing the
root causes :/

Fix ipv6_find_hdr() in net/ipv6/exthdrs_core.c

if (skb->len - start < hdrlen)
   return -EBADMSG;

Thanks Ilya & Eric, and sorry for the defensive fix. I suspected
ipv6_find_hdr() was the real problem, but I could only reproduce it 
through openvswitch here, so fixing the caller I had evidence for 
seemed like the smaller change. I'll send a v2 for ipv6_find_hdr() 
later.

N.