Re: [PATCH net v2] ipv6: do not let ipv6_find_hdr() return an offset past the packet end

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Wed, 16 Sep 2026 21:57:53 +0200 you wrote:

ipv6_find_hdr() walks the extension header chain, skipping each header by
the length that header itself declares.  ipv6_optlen() returns up to 2048,
and the skip is never checked against skb->len, so the offset stored in
*offset can point past the end of the packet.

openvswitch installs that offset as the transport header, and
update_ipv6_checksum() then reads and writes the transport checksum field
out of bounds:

[...]

Here is the summary with links:
  - [net,v2] ipv6: do not let ipv6_find_hdr() return an offset past the packet end
    https://git.kernel.org/netdev/net/c/ee319bd3a0e9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html