From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Date: Tue, 23 May 2023 08:29:44 +0000 (+0000)
Subject: ipv6: Fix out-of-bounds access in ipv6_find_tlv()
X-Git-Tag: baikal/aarch64/sdk5.10~15
X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=a26a531ad5a7d50f1800202fdd7324a5c0000f28;p=kernel.git

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

commit 878ecb0897f4737a4c9401f3523fd49589025671 upstream.

optlen is fetched without checking whether there is more than one byte to parse.
It can lead to out-of-bounds access.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: f57843b84709 ("[IPV6]: Find option offset by type.")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index da46c42846765..49e31e4ae7b7f 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type)
 			optlen = 1;
 			break;
 		default:
+			if (len < 2)
+				goto bad;
 			optlen = nh[offset + 1] + 2;
 			if (optlen > len)
 				goto bad;