[PATCH] net/ipv6: ioam6: prevent schema length wraparound in trace fill

[PATCH] net/ipv6: ioam6: prevent schema length wraparound in trace fill

[Pengpeng Hou]

ioam6_fill_trace_data() stores the schema contribution to the trace
length in a u8. With bit 22 enabled and the largest schema payload,
sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the
remaining-space check. __ioam6_fill_trace_data() then positions the
write cursor without reserving the schema area but still copies the
4-byte schema header and the full schema payload, overrunning the trace
buffer.

Keep sclen in an unsigned int so the remaining-space check and the write
cursor calculation both see the full schema length.

Fixes: 8c6f6fa67726 ("ipv6: ioam: IOAM Generic Netlink API")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 net/ipv6/ioam6.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
index b76f89d92e7b..3978773bec42 100644
--- a/net/ipv6/ioam6.c
+++ b/net/ipv6/ioam6.c
@@ -708,7 +708,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,
 				    struct ioam6_namespace *ns,
 				    struct ioam6_trace_hdr *trace,
 				    struct ioam6_schema *sc,
-				    u8 sclen, bool is_input)
+				    unsigned int sclen, bool is_input)
 {
 	struct net_device *dev = skb_dst_dev(skb);
 	struct timespec64 ts;
@@ -939,7 +939,7 @@ void ioam6_fill_trace_data(struct sk_buff *skb,
 			   bool is_input)
 {
 	struct ioam6_schema *sc;
-	u8 sclen = 0;
+	unsigned int sclen = 0;
 
 	/* Skip if Overflow flag is set
 	 */
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] net/ipv6: ioam6: prevent schema length wraparound in trace fill

[Justin Iurman]

On 3/25/26 08:41, Pengpeng Hou wrote:
> ioam6_fill_trace_data() stores the schema contribution to the trace
> length in a u8. With bit 22 enabled and the largest schema payload,
> sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the
> remaining-space check. __ioam6_fill_trace_data() then positions the
> write cursor without reserving the schema area but still copies the
> 4-byte schema header and the full schema payload, overrunning the trace
> buffer.
> 
> Keep sclen in an unsigned int so the remaining-space check and the write
> cursor calculation both see the full schema length.
> 
> Fixes: 8c6f6fa67726 ("ipv6: ioam: IOAM Generic Netlink API")

... should be:

Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated 
Trace")

Respin needed? Otherwise, LGTM.

Reviewed-by: Justin Iurman <justin.iurman@gmail.com>

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   net/ipv6/ioam6.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
> index b76f89d92e7b..3978773bec42 100644
> --- a/net/ipv6/ioam6.c
> +++ b/net/ipv6/ioam6.c
> @@ -708,7 +708,7 @@ static void __ioam6_fill_trace_data(struct sk_buff *skb,
>   				    struct ioam6_namespace *ns,
>   				    struct ioam6_trace_hdr *trace,
>   				    struct ioam6_schema *sc,
> -				    u8 sclen, bool is_input)
> +				    unsigned int sclen, bool is_input)
>   {
>   	struct net_device *dev = skb_dst_dev(skb);
>   	struct timespec64 ts;
> @@ -939,7 +939,7 @@ void ioam6_fill_trace_data(struct sk_buff *skb,
>   			   bool is_input)
>   {
>   	struct ioam6_schema *sc;
> -	u8 sclen = 0;
> +	unsigned int sclen = 0;
>   
>   	/* Skip if Overflow flag is set
>   	 */