Re: [PATCH net] openvswitch: reject a negative transport length in the IPv6 L4 checksum update

[Norbert Szetei]

On Sep 15, 2026, at 23:40, Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> 
> On Tue, Sep 15, 2026 at 2:13 PM Ilya Maximets <i.maximets@xxxxxxx> wrote:
>> 
>> 
>> Hi, Norbert.
>> 
>> This looks like something that needs to be fixed in the ipv6_find_hdr().
>> IMO, this function should not return an offset that doesn't exist in the
>> packet, i.e. we should not be able to find what's not in there.
>> 
>> CC: David and Ido.
>> 
>> In general, we should be able to trust the skb_transport_offset(),
>> otherwise there could be other issues all over the place, not only in
>> openvswitch.
> 
> Totally agree.
> We keep receiving defensive code instead of finding and fixing the
> root causes :/
> 
> Fix ipv6_find_hdr() in net/ipv6/exthdrs_core.c
> 
> if (skb->len - start < hdrlen)
>    return -EBADMSG;

Thanks Ilya & Eric, and sorry for the defensive fix. I suspected
ipv6_find_hdr() was the real problem, but I could only reproduce it 
through openvswitch here, so fixing the caller I had evidence for 
seemed like the smaller change. I'll send a v2 for ipv6_find_hdr() 
later.

N.