Skip to content
Browse files

netfilter: ipv6: nf_defrag: drop mangled skb on ream error

Dmitry Vyukov reported GPF in network stack that Andrey traced down to
negative nh offset in nf_ct_frag6_queue().

Problem is that all network headers before fragment header are pulled.
Normal ipv6 reassembly will drop the skb when errors occur further down
the line.

netfilter doesn't do this, and instead passed the original fragment
along.  That was also fine back when netfilter ipv6 defrag worked with
cloned fragments, as the original, pristine fragment was passed on.

So we either have to undo the pull op, or discard such fragments.
Since they're malformed after all (e.g. overlapping fragment) it seems
preferrable to just drop them.

Same for temporary errors -- it doesn't make sense to accept (and
perhaps forward!) only some fragments of same datagram.

Fixes: 029f7f3 ("netfilter: ipv6: nf_defrag: avoid/free clone operations")
Reported-by: Dmitry Vyukov <>
Debugged-by: Andrey Konovalov <>
Diagnosed-by: Eric Dumazet <Eric Dumazet <>
Signed-off-by: Florian Westphal <>
Acked-by: Eric Dumazet <>
Signed-off-by: Pablo Neira Ayuso <>
  • Loading branch information...
Florian Westphal authored and ummakynes committed Nov 29, 2016
1 parent 5173bc6 commit 9b57da0630c9fd36ed7a20fc0f98dc82cc0777fa
Showing with 3 additions and 3 deletions.
  1. +2 −2 net/ipv6/netfilter/nf_conntrack_reasm.c
  2. +1 −1 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -576,11 +576,11 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
/* Jumbo payload inhibits frag. header */
if (ipv6_hdr(skb)->payload_len == 0) {
pr_debug("payload len = 0\n");
return -EINVAL;
return 0;

if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
return -EINVAL;
return 0;

if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
return -ENOMEM;
@@ -69,7 +69,7 @@ static unsigned int ipv6_defrag(void *priv,
if (err == -EINPROGRESS)
return NF_STOLEN;

return NF_ACCEPT;
return err == 0 ? NF_ACCEPT : NF_DROP;

static struct nf_hook_ops ipv6_defrag_ops[] = {

0 comments on commit 9b57da0

Please sign in to comment.
You can’t perform that action at this time.