Re: [PATCH nf v2] netfilter: ip6tables: set hotdrop for malformed extension header matches
kernel test robot <[email protected]> Wed, 15 Jul 2026 06:26:42 +0800
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network |
|---|---|
| Message-ID | <[email protected]> |
Hi Zhixing, kernel test robot noticed the following build warnings: [auto build test WARNING on netfilter-nf/main] [also build test WARNING on nf-next/main linus/master v7.2-rc3 next-20260713] [cannot apply to linux-review/Zhixing-Chen/netfilter-ip6tables-set-hotdrop-for-malformed-extension-header-matches/20260709-143240 horms-ipvs/master] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Zhixing-Chen/netfilter-ip6tables-set-hotdrop-for-malformed-extension-header-matches/20260714-114506 base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main patch link: https://lore.kernel.org/r/20260714032124.7042-1-running910%40gmail.com patch subject: [PATCH nf v2] netfilter: ip6tables: set hotdrop for malformed extension header matches config: openrisc-allmodconfig (https://download.01.org/0day-ci/archive/20260715/[email protected]/config) compiler: or1k-linux-gcc (GCC) 16.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260715/[email protected]/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <[email protected]> | Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/ All warnings (new ones prefixed by >>): net/ipv6/netfilter/ip6t_ipv6header.c: In function 'ipv6header_mt6': >> net/ipv6/netfilter/ip6t_ipv6header.c:31:13: warning: variable 'len' set but not used [-Wunused-but-set-variable=] 31 | int len; | ^~~ vim +/len +31 net/ipv6/netfilter/ip6t_ipv6header.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 25 1d93a9cbad608f Jan Engelhardt 2007-07-07 26 static bool 62fc8051083a33 Jan Engelhardt 2009-07-07 27 ipv6header_mt6(const struct sk_buff *skb, struct xt_action_param *par) ^1da177e4c3f41 Linus Torvalds 2005-04-16 28 { f7108a20dee44e Jan Engelhardt 2008-10-08 29 const struct ip6t_ipv6header_info *info = par->matchinfo; ^1da177e4c3f41 Linus Torvalds 2005-04-16 30 unsigned int temp; ^1da177e4c3f41 Linus Torvalds 2005-04-16 @31 int len; ^1da177e4c3f41 Linus Torvalds 2005-04-16 32 u8 nexthdr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 33 unsigned int ptr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 34 ^1da177e4c3f41 Linus Torvalds 2005-04-16 35 /* Make sure this isn't an evil packet */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 36 ^1da177e4c3f41 Linus Torvalds 2005-04-16 37 /* type of the 1st exthdr */ 0660e03f6b18f1 Arnaldo Carvalho de Melo 2007-04-25 38 nexthdr = ipv6_hdr(skb)->nexthdr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 39 /* pointer to the 1st exthdr */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 40 ptr = sizeof(struct ipv6hdr); ^1da177e4c3f41 Linus Torvalds 2005-04-16 41 /* available length */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 42 len = skb->len - ptr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 43 temp = 0; ^1da177e4c3f41 Linus Torvalds 2005-04-16 44 44dde23698a7a8 Jeremy Sowden 2019-09-13 45 while (nf_ip6_ext_hdr(nexthdr)) { 3cf93c96af7adf Jan Engelhardt 2008-04-14 46 const struct ipv6_opt_hdr *hp; 3cf93c96af7adf Jan Engelhardt 2008-04-14 47 struct ipv6_opt_hdr _hdr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 48 int hdrlen; ^1da177e4c3f41 Linus Torvalds 2005-04-16 49 ^1da177e4c3f41 Linus Torvalds 2005-04-16 50 /* No more exthdr -> evaluate */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 51 if (nexthdr == NEXTHDR_NONE) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 52 temp |= MASK_NONE; ^1da177e4c3f41 Linus Torvalds 2005-04-16 53 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 54 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 55 /* ESP -> evaluate */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 56 if (nexthdr == NEXTHDR_ESP) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 57 temp |= MASK_ESP; ^1da177e4c3f41 Linus Torvalds 2005-04-16 58 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 59 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 60 ^1da177e4c3f41 Linus Torvalds 2005-04-16 61 hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr); 70c0eb1ca016f7 Florian Westphal 2018-09-04 62 if (!hp) { 70c0eb1ca016f7 Florian Westphal 2018-09-04 63 par->hotdrop = true; 70c0eb1ca016f7 Florian Westphal 2018-09-04 64 return false; 70c0eb1ca016f7 Florian Westphal 2018-09-04 65 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 66 ^1da177e4c3f41 Linus Torvalds 2005-04-16 67 /* Calculate the header length */ 7c4e36bc172ae1 Jan Engelhardt 2007-07-07 68 if (nexthdr == NEXTHDR_FRAGMENT) ^1da177e4c3f41 Linus Torvalds 2005-04-16 69 hdrlen = 8; 7c4e36bc172ae1 Jan Engelhardt 2007-07-07 70 else if (nexthdr == NEXTHDR_AUTH) 416e8126a2672f yangxingwu 2019-07-10 71 hdrlen = ipv6_authlen(hp); ^1da177e4c3f41 Linus Torvalds 2005-04-16 72 else ^1da177e4c3f41 Linus Torvalds 2005-04-16 73 hdrlen = ipv6_optlen(hp); ^1da177e4c3f41 Linus Torvalds 2005-04-16 74 ^1da177e4c3f41 Linus Torvalds 2005-04-16 75 /* set the flag */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 76 switch (nexthdr) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 77 case NEXTHDR_HOP: ^1da177e4c3f41 Linus Torvalds 2005-04-16 78 temp |= MASK_HOPOPTS; ^1da177e4c3f41 Linus Torvalds 2005-04-16 79 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 80 case NEXTHDR_ROUTING: ^1da177e4c3f41 Linus Torvalds 2005-04-16 81 temp |= MASK_ROUTING; ^1da177e4c3f41 Linus Torvalds 2005-04-16 82 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 83 case NEXTHDR_FRAGMENT: ^1da177e4c3f41 Linus Torvalds 2005-04-16 84 temp |= MASK_FRAGMENT; ^1da177e4c3f41 Linus Torvalds 2005-04-16 85 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 86 case NEXTHDR_AUTH: ^1da177e4c3f41 Linus Torvalds 2005-04-16 87 temp |= MASK_AH; ^1da177e4c3f41 Linus Torvalds 2005-04-16 88 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 89 case NEXTHDR_DEST: ^1da177e4c3f41 Linus Torvalds 2005-04-16 90 temp |= MASK_DSTOPTS; ^1da177e4c3f41 Linus Torvalds 2005-04-16 91 break; ^1da177e4c3f41 Linus Torvalds 2005-04-16 92 default: 1d93a9cbad608f Jan Engelhardt 2007-07-07 93 return false; ^1da177e4c3f41 Linus Torvalds 2005-04-16 94 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 95 ^1da177e4c3f41 Linus Torvalds 2005-04-16 96 nexthdr = hp->nexthdr; ^1da177e4c3f41 Linus Torvalds 2005-04-16 97 len -= hdrlen; ^1da177e4c3f41 Linus Torvalds 2005-04-16 98 ptr += hdrlen; aebe9616a67760 Zhixing Chen 2026-07-14 99 if (ptr > skb->len) { aebe9616a67760 Zhixing Chen 2026-07-14 100 par->hotdrop = true; aebe9616a67760 Zhixing Chen 2026-07-14 101 return false; aebe9616a67760 Zhixing Chen 2026-07-14 102 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 103 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 104 7c4e36bc172ae1 Jan Engelhardt 2007-07-07 105 if (nexthdr != NEXTHDR_NONE && nexthdr != NEXTHDR_ESP) ^1da177e4c3f41 Linus Torvalds 2005-04-16 106 temp |= MASK_PROTO; ^1da177e4c3f41 Linus Torvalds 2005-04-16 107 ^1da177e4c3f41 Linus Torvalds 2005-04-16 108 if (info->modeflag) ^1da177e4c3f41 Linus Torvalds 2005-04-16 109 return !((temp ^ info->matchflags ^ info->invflags) ^1da177e4c3f41 Linus Torvalds 2005-04-16 110 & info->matchflags); ^1da177e4c3f41 Linus Torvalds 2005-04-16 111 else { ^1da177e4c3f41 Linus Torvalds 2005-04-16 112 if (info->invflags) ^1da177e4c3f41 Linus Torvalds 2005-04-16 113 return temp != info->matchflags; ^1da177e4c3f41 Linus Torvalds 2005-04-16 114 else ^1da177e4c3f41 Linus Torvalds 2005-04-16 115 return temp == info->matchflags; ^1da177e4c3f41 Linus Torvalds 2005-04-16 116 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 117 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 118 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki