In xfrm4_remove_beet_encap(), when the BEET pseudo-header is present (XFRM_MODE_SKB_CB(skb)->protocol == IPPROTO_BEETPH), two validation flaws exist in option decapsulation: 1. optlen is checked against `optlen > 250` instead of `MAX_IPOPTLEN` (40). Later, `iph->ihl += optlen / 4` adds up to 62 to the 4-bit `iph->ihl` field (which starts at 5), wrapping the 4-bit unsigned bitfield around 16 and producing a bogus IPv4 header length smaller than 20 bytes. 2. Only `pskb_may_pull(skb, phlen)` is checked before `__skb_pull(skb, phlen)` and `ip_fast_csum(skb_network_header(skb), iph->ihl)`. If the trailing `optlen` bytes reside in non-linear skb fragments (or beyond the packet), `ip_fast_csum()` reads `optlen` bytes past `skb_tail_pointer(skb)`. Cap `optlen` at `MAX_IPOPTLEN` (40) and ensure `pskb_may_pull(skb, phlen + optlen)` succeeds before pulling `phlen`. Fixes: 0a69452cb45a ("[XFRM]: BEET mode") Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input") Assisted-by: LLM Signed-off-by: Hui Peng --- net/xfrm/xfrm_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 5ed87d51392a..3ed5fb0c755c 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -197,12 +197,12 @@ static int xfrm4_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb) phlen = sizeof(*ph) + ph->padlen; optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen); - if (optlen < 0 || optlen & 3 || optlen > 250) + if (optlen < 0 || optlen & 3 || optlen > MAX_IPOPTLEN) goto out; XFRM_MODE_SKB_CB(skb)->protocol = ph->nexthdr; - if (!pskb_may_pull(skb, phlen)) + if (!pskb_may_pull(skb, phlen + optlen)) goto out; __skb_pull(skb, phlen); } -- 2.55.0.1082.g2b9226bbc0-goog