Re: [PATCH] xfrm: iptfs: fix runt reassembly panic from short inner tot_len

On Mon, Aug 03, 2026 at 12:01:54PM +0800, Henry Martin wrote:
> When the start of an inner packet is split across two outer packets
> such that fewer than 4 bytes land at the end of the first one,
> __input_process_payload() saves those bytes as a runt and skips the
> iplen/iphlen validation performed for in-place packets. When the
> continuation packet arrives, iptfs_reassem_cont() only requires the
> declared inner length to be >= sizeof(ra_runt) (6) before allocating
> the reassembly skb with that attacker-controlled length.
> 
> However, __iptfs_iphlen() always returns the fixed minimum IP header
> size (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in
> [6, 19] the header-completion copy writes past the declared packet
> length, and the subsequent "ipremain -= copylen" underflows to ~4GB,
> leaving the payload copy length bounded only by blkoff (up to 64KB).
> At runtime the skb_put() tailroom check turns this into
> skb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable
> locally via userns+netns IPTFS SAs and remotely against IPTFS VPN
> gateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,
> tun/tap delivery).
> 
> Align the runt path with the normal path by requiring the declared
> inner length to cover at least the IP header size. This also subsumes
> the previous >= sizeof(ra_runt) check, since the minimum IP header
> is always larger than the runt buffer.
> 
> This issue was found by the autokbug dynamic kernel fuzzer at
> Tencent Yunding Lab.
> 
> Fixes: 075694765446 ("xfrm: iptfs: handle received fragmented inner packets")
> Reported-by: Henry Martin <[email protected]>
> Signed-off-by: Henry Martin <[email protected]>

Applied to the ipsec tree, thanks a lot!