[PATCH iproute2 v2 1/2] ip route: use the request size as the limit when adding encap

[PATCH iproute2 v2 1/2] ip route: use the request size as the limit when adding encap

[Fang Jiabao]

iproute_modify() passes a hardcoded 1024 as the size limit to
addraw_l() when it adds the encap attribute. The request buffer is
larger than that, and every other attribute in this function is bounded
by sizeof(req). With a seg6 encap of 60 segments the request still fits
in the buffer, but addraw_l() prints "addraw_l ERROR: message exceeded
bound of 1024" and returns -1. The return value is ignored, so ip sends
the request without the encap attribute and exits with status 0, and a
route without encap is installed silently.

Use sizeof(req) as the limit, like the other attributes, and return an
error if addraw_l() fails instead of sending an incomplete request.

Fixes: 1e5293056a02 ("lwtunnel: Add encapsulation support to ip route")
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Fang Jiabao <kaquoin@163.com>
---
Changes since v1:
  - use sizeof(req) as the limit instead of 1024, as suggested by
    Stephen Hemminger; keep the check of the return value
  - rewrite the commit message to describe the cause
  - add the same fix for ip nexthop as patch 2/2
v1: https://lore.kernel.org/netdev/20261102090535.226168-1-kaquoin@163.com/

Tested on current main (d95f6650, "man: ip-neighbour.8: document
protocol keyword"), in a network namespace with a dummy device, with:

  ip -6 route add fc00:ff::N/128 encap seg6 mode encap segs <N SIDs> dev d0

With 59, 60 and 62 segments the route is added with encap, exit status
0. Before, 60 segments printed an addraw_l() error and installed a route
without encap, exit status 0 (observed on e4cd9f1d, the only commit
since then changes a man page). With 63 segments the result is
unchanged: error from lwt_parse_encap(), exit status 255, no route
installed. I did not find a way to make addraw_l() fail from the command
line after this change, so that error path is not tested.

 ip/iproute.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/ip/iproute.c b/ip/iproute.c
index 1ce71f78..067569c2 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -1525,9 +1525,10 @@ static int iproute_modify(int cmd, unsigned int flags, int argc, char **argv)
 			lwt_parse_encap(rta, sizeof(buf), &argc, &argv,
 					RTA_ENCAP, RTA_ENCAP_TYPE);
 
-			if (rta->rta_len > RTA_LENGTH(0))
-				addraw_l(&req.n, 1024
-					 , RTA_DATA(rta), RTA_PAYLOAD(rta));
+			if (rta->rta_len > RTA_LENGTH(0) &&
+			    addraw_l(&req.n, sizeof(req), RTA_DATA(rta),
+				     RTA_PAYLOAD(rta)) < 0)
+				return -1;
 		} else if (strcmp(*argv, "ttl-propagate") == 0) {
 			__u8 ttl_prop;
 
-- 
2.43.0

[PATCH iproute2 v2 2/2] ip nexthop: use the request size as the limit when adding encap

[Fang Jiabao]

ipnh_modify() passes a hardcoded 1024 as the size limit to addraw_l()
when it adds the encap attribute, and ignores the return value. Every
other attribute in this function is bounded by sizeof(req). If the encap
attribute does not fit, for example a seg6 encap with 59 segments,
addraw_l() prints "addraw_l ERROR: message exceeded bound of 1024" and
returns -1, but ip sends the request without the encap attribute and
exits with status 0. A nexthop without encap is then installed silently.

Use sizeof(req) as the limit, like the other attributes, and return an
error if addraw_l() fails instead of sending an incomplete request.

Fixes: 63df8e8543b0 ("Add support for nexthop objects")
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Fang Jiabao <kaquoin@163.com>
---
Changes since v1: new patch, the same problem in ip nexthop, as
requested by Stephen Hemminger.

Tested on current main (d95f6650, "man: ip-neighbour.8: document
protocol keyword"), in a network namespace with a dummy device, with:

  ip nexthop add id N via fc00:ee::1 dev d0 encap seg6 mode encap segs <N SIDs>

Before: with 59 segments or more, addraw_l() prints its error, the exit
status is 0 and the nexthop is installed without encap (observed on
e4cd9f1d, the only commit since then changes a man page). After: 58, 59
and 60 segments are added with encap, exit status 0. With 61 and 62
segments "addraw_l ERROR: message exceeded bound of 1048" is printed,
the exit status is 1 and no nexthop is installed.

The request buffer in ipnh_modify() is only 1024 bytes, so sizeof(req)
is barely larger than the old limit. I did not change the buffer size.

 ip/ipnexthop.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ip/ipnexthop.c b/ip/ipnexthop.c
index ad8ad0c0..ae6a28d4 100644
--- a/ip/ipnexthop.c
+++ b/ip/ipnexthop.c
@@ -1108,10 +1108,10 @@ static int ipnh_modify(int cmd, unsigned int flags, int argc, char **argv)
 			lwt_parse_encap(rta, sizeof(buf), &argc, &argv,
 					NHA_ENCAP, NHA_ENCAP_TYPE);
 
-			if (rta->rta_len > RTA_LENGTH(0)) {
-				addraw_l(&req.n, 1024, RTA_DATA(rta),
-					 RTA_PAYLOAD(rta));
-			}
+			if (rta->rta_len > RTA_LENGTH(0) &&
+			    addraw_l(&req.n, sizeof(req), RTA_DATA(rta),
+				     RTA_PAYLOAD(rta)) < 0)
+				return -1;
 		} else if (!strcmp(*argv, "blackhole")) {
 			addattr_l(&req.n, sizeof(req), NHA_BLACKHOLE, NULL, 0);
 			if (req.nhm.nh_family == AF_UNSPEC)
-- 
2.43.0

Re: [PATCH iproute2 v2 1/2] ip route: use the request size as the limit when adding encap

[patchwork-bot+netdevbpf]

Hello:

This series was applied to iproute2/iproute2.git (main)
by Stephen Hemminger <stephen@networkplumber.org>:

On Mon,  9 Nov 2026 13:32:08 +0800 you wrote:
> iproute_modify() passes a hardcoded 1024 as the size limit to
> addraw_l() when it adds the encap attribute. The request buffer is
> larger than that, and every other attribute in this function is bounded
> by sizeof(req). With a seg6 encap of 60 segments the request still fits
> in the buffer, but addraw_l() prints "addraw_l ERROR: message exceeded
> bound of 1024" and returns -1. The return value is ignored, so ip sends
> the request without the encap attribute and exits with status 0, and a
> route without encap is installed silently.
> 
> [...]

Here is the summary with links:
  - [iproute2,v2,1/2] ip route: use the request size as the limit when adding encap
    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=c4a39013ba80
  - [iproute2,v2,2/2] ip nexthop: use the request size as the limit when adding encap
    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=1d64d3416d60

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html