From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A240238C0A; Tue, 17 Jun 2025 16:28:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750177714; cv=none; b=MscrBV+Rbyu65IHPyERIRMRiYlcN1csRFVIuuKRAZWxO+nFcK7aPcOoLp/ifw+9MdMZdg0ptbEMSfza3v4G8q9/geZSQitS+ax8wyrE1i7jUmNS5WSPTvBx7Kt+JrmeIJ3QPB0RPsFlG1m9o/gO8y6x9sMQlHFThFmRxGvL15sE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750177714; c=relaxed/simple; bh=uB4IFMb7KM5juBOpZv10i78lxEv3wX6il79QCJi71T4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rtwxZOpDcCd31ZkwRnTgb4kkVjjcqZwqu0Vbdle+m+f9OKTPAD2BXUWZBF8JHX5KC02Zsx2d+VWQuRHe3AjqOYE7vu9uF6PSrp+t/WqvubgaRUbgxFSC4g6ImPn320t6ND6uDLotq+DEFtdaNSJ0OfIw9hts8qWFkei51IO6u6A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=q4dDjSCz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="q4dDjSCz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3DB0C4CEE3; Tue, 17 Jun 2025 16:28:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1750177714; bh=uB4IFMb7KM5juBOpZv10i78lxEv3wX6il79QCJi71T4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q4dDjSCzi9jEzBCHeDcpRj52Zp77x5G8lkMXjQ+NzUYPVoH41OVAuoqfA+ZPE1ddA Xw9eOsqLkNzPcQKkEAQELxT3VxoILxytZqiN/ZzFnPAqn6ZIetoNq1Aze55RrQic40 GT+2K0wZ5cVnp4GSq4LOjx7EfXMNqFKGYb7uHwq0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Petr Machata , Ido Schimmel , David Ahern , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.12 385/512] seg6: Fix validation of nexthop addresses Date: Tue, 17 Jun 2025 17:25:51 +0200 Message-ID: <20250617152435.184844813@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250617152419.512865572@linuxfoundation.org> References: <20250617152419.512865572@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ido Schimmel [ Upstream commit 7632fedb266d93ed0ed9f487133e6c6314a9b2d1 ] The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one. Fix by validating that the provided length exactly matches the specified one. Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20250604113252.371528-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv6/seg6_local.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index c74705ead9849..e445a0a45568d 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -1644,10 +1644,8 @@ static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = { [SEG6_LOCAL_SRH] = { .type = NLA_BINARY }, [SEG6_LOCAL_TABLE] = { .type = NLA_U32 }, [SEG6_LOCAL_VRFTABLE] = { .type = NLA_U32 }, - [SEG6_LOCAL_NH4] = { .type = NLA_BINARY, - .len = sizeof(struct in_addr) }, - [SEG6_LOCAL_NH6] = { .type = NLA_BINARY, - .len = sizeof(struct in6_addr) }, + [SEG6_LOCAL_NH4] = NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), + [SEG6_LOCAL_NH6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), [SEG6_LOCAL_IIF] = { .type = NLA_U32 }, [SEG6_LOCAL_OIF] = { .type = NLA_U32 }, [SEG6_LOCAL_BPF] = { .type = NLA_NESTED }, -- 2.39.5