[PATCH net] seg6: Fix validation of nexthop addresses

[PATCH net] seg6: Fix validation of nexthop addresses

[Ido Schimmel]

The kernel currently validates that the length of the provided nexthop
address does not exceed the specified length. This can lead to the
kernel reading uninitialized memory if user space provided a shorter
length than the specified one.

Fix by validating that the provided length exactly matches the specified
one.

Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
Noticed this while extending End.X behavior with oif support.
---
 net/ipv6/seg6_local.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index ac1dbd492c22..a11a02b4ba95 100644
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -1644,10 +1644,8 @@ static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = {
 	[SEG6_LOCAL_SRH]	= { .type = NLA_BINARY },
 	[SEG6_LOCAL_TABLE]	= { .type = NLA_U32 },
 	[SEG6_LOCAL_VRFTABLE]	= { .type = NLA_U32 },
-	[SEG6_LOCAL_NH4]	= { .type = NLA_BINARY,
-				    .len = sizeof(struct in_addr) },
-	[SEG6_LOCAL_NH6]	= { .type = NLA_BINARY,
-				    .len = sizeof(struct in6_addr) },
+	[SEG6_LOCAL_NH4]	= NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)),
+	[SEG6_LOCAL_NH6]	= NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
 	[SEG6_LOCAL_IIF]	= { .type = NLA_U32 },
 	[SEG6_LOCAL_OIF]	= { .type = NLA_U32 },
 	[SEG6_LOCAL_BPF]	= { .type = NLA_NESTED },
-- 
2.49.0

Re: [PATCH net] seg6: Fix validation of nexthop addresses

[David Ahern]

On 6/4/25 5:32 AM, Ido Schimmel wrote:
> The kernel currently validates that the length of the provided nexthop
> address does not exceed the specified length. This can lead to the
> kernel reading uninitialized memory if user space provided a shorter
> length than the specified one.
> 
> Fix by validating that the provided length exactly matches the specified
> one.
> 
> Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
> Reviewed-by: Petr Machata <petrm@nvidia.com>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
> Noticed this while extending End.X behavior with oif support.
> ---
>  net/ipv6/seg6_local.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net] seg6: Fix validation of nexthop addresses

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 4 Jun 2025 14:32:52 +0300 you wrote:
> The kernel currently validates that the length of the provided nexthop
> address does not exceed the specified length. This can lead to the
> kernel reading uninitialized memory if user space provided a shorter
> length than the specified one.
> 
> Fix by validating that the provided length exactly matches the specified
> one.
> 
> [...]

Here is the summary with links:
  - [net] seg6: Fix validation of nexthop addresses
    https://git.kernel.org/netdev/net/c/7632fedb266d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html