)]}'
{
  "commit": "dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c",
  "tree": "84d7295475d2bd283a793f89e38b8075950d710b",
  "parents": [
    "42d100f5232f39b8ea7b00a7c2482325c7f032a4"
  ],
  "author": {
    "name": "Henry Martin",
    "email": "bsdhenrymartin@gmail.com",
    "time": "Mon Aug 03 12:01:54 2026 +0800"
  },
  "committer": {
    "name": "Steffen Klassert",
    "email": "steffen.klassert@secunet.com",
    "time": "Tue Aug 18 12:16:18 2026 +0200"
  },
  "message": "xfrm: iptfs: fix runt reassembly panic from short inner tot_len\n\nWhen the start of an inner packet is split across two outer packets\nsuch that fewer than 4 bytes land at the end of the first one,\n__input_process_payload() saves those bytes as a runt and skips the\niplen/iphlen validation performed for in-place packets. When the\ncontinuation packet arrives, iptfs_reassem_cont() only requires the\ndeclared inner length to be \u003e\u003d sizeof(ra_runt) (6) before allocating\nthe reassembly skb with that attacker-controlled length.\n\nHowever, __iptfs_iphlen() always returns the fixed minimum IP header\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in\n[6, 19] the header-completion copy writes past the declared packet\nlength, and the subsequent \"ipremain -\u003d copylen\" underflows to ~4GB,\nleaving the payload copy length bounded only by blkoff (up to 64KB).\nAt runtime the skb_put() tailroom check turns this into\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,\ntun/tap delivery).\n\nAlign the runt path with the normal path by requiring the declared\ninner length to cover at least the IP header size. This also subsumes\nthe previous \u003e\u003d sizeof(ra_runt) check, since the minimum IP header\nis always larger than the runt buffer.\n\nThis issue was found by the autokbug dynamic kernel fuzzer at\nTencent Yunding Lab.\n\nFixes: 075694765446 (\"xfrm: iptfs: handle received fragmented inner packets\")\nReported-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2ce15c472cc4db7e0a710d1b8c356e81e7daf318",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_iptfs.c",
      "new_id": "6920940a35b49d2e95e3468c35f199549bf5b121",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_iptfs.c"
    }
  ]
}