[PATCH net] calipso: update payload_len when removing the CALIPSO option

[Paul Moore]

On Wed, Oct 7, 2026 at 4:45 PM Eric Dumazet <edumazet at kernel.org> wrote:
> Le mer. 7 oct. 2026 à 17:26, Joas Antonio dos Santos
> <joasantonio108 at gmail.com> a écrit :
> >
> > calipso_skbuff_delattr() removes the CALIPSO option from the hop-by-hop
> > extension header, or the whole extension header if CALIPSO is its only
> > option, and pulls the skb by the removed length.  It never updates
> > ipv6hdr->payload_len, so after a successful removal the header still
> > claims the original length.
> >
> > calipso_skbuff_setattr() already adjusts payload_len by the length it
> > adds; the delete path was missed.
> >
> > This is reached on the forward path when a packet carrying CALIPSO is
> > sent to a destination mapped to an unlabeled NetLabel domain.  The
> > forwarded packet then has a payload_len larger than its real payload
> > by the removed length (8 to 264 bytes), and the receiver drops it as
> > truncated.
> >
> > Adjust payload_len after the header is moved.
> >
> > Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.")
> > Signed-off-by: Joas Antonio dos Santos <joasantonio108 at gmail.com>
> > Assisted-by: Claude:claude-opus-5-5
> > ---
> > Found by code review.  Compile-tested only (arm64, W=1); not runtime-tested.
>
> The analysis looks right to me, but this means removing the label on
> the forward path has been broken since 2016 for every packet that is
> not resegmented later (SYN, UDP, ICMPv6...).

I'm going to follow-up with a review on the v2 posting but I just
wanted to add a quick comment that while basic CALIPSO labeling is
tested via an automated test job, this particular code path is not
part of the automated testing.  Improvements to the tests are always
welcome.

https://github.com/SELinuxProject/selinux-testsuite
https://github.com/SELinuxProject/selinux-testsuite/tree/main/tests/inet_socket

-- 
paul-moore.com