[PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR

Linux kernel -stable discussions
 help / color / mirror / Atom feed

* [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
       [not found] <aq-E5MPYZS5s9_bk@fedora>
@ 2026-09-21  4:40 ` Hui Peng
  2026-09-21  6:34   ` Hangbin Liu
                     ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Hui Peng @ 2026-09-21  4:40 UTC (permalink / raw)
  To: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni
  Cc: Hangbin Liu, Simon Horman, David Lebrun, netdev, linux-kernel,
	stable, Hui Peng

In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
.len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
maximum payload length and permits shorter payloads (e.g., 0 bytes).
When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
skb->head memory, which is stored in sdata->tun_src and leaked back to
userspace via SEG6_CMD_GET_TUNSRC.

Switch SEG6_ATTR_DST in seg6_genl_policy to
NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
validation rejects any attribute whose length is not exactly
sizeof(struct in6_addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
uninitialized kernel heap memory (tun_src =
836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
-ERANGE (-34) and tun_src remains zeroed.

Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
  sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
  NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
  length, as pointed out by Hangbin Liu.

 net/ipv6/seg6.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 62a7eb779202..8c2b156c227a 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -138,8 +138,8 @@ void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
 static struct genl_family seg6_genl_family;
 
 static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
-	[SEG6_ATTR_DST]				= { .type = NLA_BINARY,
-		.len = sizeof(struct in6_addr) },
+	[SEG6_ATTR_DST]				=
+		NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
 	[SEG6_ATTR_DSTLEN]			= { .type = NLA_S32, },
 	[SEG6_ATTR_HMACKEYID]		= { .type = NLA_U32, },
 	[SEG6_ATTR_SECRET]			= { .type = NLA_BINARY, },
-- 
2.49.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
@ 2026-09-21  6:34   ` Hangbin Liu
  2026-09-21 22:07   ` Justin Iurman
                     ` (3 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: Hangbin Liu @ 2026-09-21  6:34 UTC (permalink / raw)
  To: Hui Peng
  Cc: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni, Simon Horman, David Lebrun, netdev, linux-kernel,
	stable

On Mon, Sep 21, 2026 at 04:40:25AM +0000, Hui Peng wrote:
> In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> maximum payload length and permits shorter payloads (e.g., 0 bytes).
> When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> skb->head memory, which is stored in sdata->tun_src and leaked back to
> userspace via SEG6_CMD_GET_TUNSRC.
> 
> Switch SEG6_ATTR_DST in seg6_genl_policy to
> NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
> validation rejects any attribute whose length is not exactly
> sizeof(struct in6_addr) with -ERANGE.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
> Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
> by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
> succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
> uninitialized kernel heap memory (tun_src =
> 836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
> SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
> -ERANGE (-34) and tun_src remains zeroed.
> 
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
>   sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
>   NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
>   length, as pointed out by Hangbin Liu.
> 
>  net/ipv6/seg6.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> index 62a7eb779202..8c2b156c227a 100644
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -138,8 +138,8 @@ void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
>  static struct genl_family seg6_genl_family;
>  
>  static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
> -	[SEG6_ATTR_DST]				= { .type = NLA_BINARY,
> -		.len = sizeof(struct in6_addr) },
> +	[SEG6_ATTR_DST]				=
> +		NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
>  	[SEG6_ATTR_DSTLEN]			= { .type = NLA_S32, },
>  	[SEG6_ATTR_HMACKEYID]		= { .type = NLA_U32, },
>  	[SEG6_ATTR_SECRET]			= { .type = NLA_BINARY, },
> -- 
> 2.49.0

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
  2026-09-21  6:34   ` Hangbin Liu
@ 2026-09-21 22:07   ` Justin Iurman
  2026-09-23 22:52   ` Andrea Mayer
                     ` (2 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: Justin Iurman @ 2026-09-21 22:07 UTC (permalink / raw)
  To: Hui Peng, Andrea Mayer, David S . Miller, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni
  Cc: Hangbin Liu, Simon Horman, David Lebrun, netdev, linux-kernel,
	stable

On 9/21/26 06:40, Hui Peng wrote:
> In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> maximum payload length and permits shorter payloads (e.g., 0 bytes).
> When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> skb->head memory, which is stored in sdata->tun_src and leaked back to
> userspace via SEG6_CMD_GET_TUNSRC.
> 
> Switch SEG6_ATTR_DST in seg6_genl_policy to
> NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
> validation rejects any attribute whose length is not exactly
> sizeof(struct in6_addr) with -ERANGE.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
> Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
> by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
> succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
> uninitialized kernel heap memory (tun_src =
> 836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
> SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
> -ERANGE (-34) and tun_src remains zeroed.
> 
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
>    sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
>    NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
>    length, as pointed out by Hangbin Liu.
> 
>   net/ipv6/seg6.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> index 62a7eb779202..8c2b156c227a 100644
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -138,8 +138,8 @@ void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
>   static struct genl_family seg6_genl_family;
>   
>   static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
> -	[SEG6_ATTR_DST]				= { .type = NLA_BINARY,
> -		.len = sizeof(struct in6_addr) },
> +	[SEG6_ATTR_DST]				=
> +		NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
>   	[SEG6_ATTR_DSTLEN]			= { .type = NLA_S32, },
>   	[SEG6_ATTR_HMACKEYID]		= { .type = NLA_U32, },
>   	[SEG6_ATTR_SECRET]			= { .type = NLA_BINARY, },

Reviewed-by: Justin Iurman <justin.iurman@gmail.com>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
  2026-09-21  6:34   ` Hangbin Liu
  2026-09-21 22:07   ` Justin Iurman
@ 2026-09-23 22:52   ` Andrea Mayer
  2026-09-24  1:34   ` Jakub Kicinski
  2026-09-24  1:40   ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: Andrea Mayer @ 2026-09-23 22:52 UTC (permalink / raw)
  To: Hui Peng
  Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
	Hangbin Liu, Simon Horman, David Lebrun, netdev, linux-kernel,
	stable, Andrea Mayer

On Mon, 21 Sep 2026 04:40:25 +0000
Hui Peng <benquike@gmail.com> wrote:

> In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> maximum payload length and permits shorter payloads (e.g., 0 bytes).
> When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> skb->head memory, which is stored in sdata->tun_src and leaked back to
> userspace via SEG6_CMD_GET_TUNSRC.
> 
> Switch SEG6_ATTR_DST in seg6_genl_policy to
> NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
> validation rejects any attribute whose length is not exactly
> sizeof(struct in6_addr) with -ERANGE.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
> Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
> by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
> succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
> uninitialized kernel heap memory (tun_src =
> 836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
> SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
> -ERANGE (-34) and tun_src remains zeroed.
> 
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
>   sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
>   NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
>   length, as pointed out by Hangbin Liu.
> 
>  net/ipv6/seg6.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Thanks,
Andrea

Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
                     ` (2 preceding siblings ...)
  2026-09-23 22:52   ` Andrea Mayer
@ 2026-09-24  1:34   ` Jakub Kicinski
  2026-09-24  1:40   ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2026-09-24  1:34 UTC (permalink / raw)
  To: Hui Peng
  Cc: Andrea Mayer, David S . Miller, Eric Dumazet, Paolo Abeni,
	Hangbin Liu, Simon Horman, David Lebrun, netdev, linux-kernel,
	stable

On Mon, 21 Sep 2026 04:40:25 +0000 Hui Peng wrote:
> Subject: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

Do not send patches in replies to existing threads.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
                     ` (3 preceding siblings ...)
  2026-09-24  1:34   ` Jakub Kicinski
@ 2026-09-24  1:40   ` patchwork-bot+netdevbpf
  4 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-09-24  1:40 UTC (permalink / raw)
  To: Hui Peng
  Cc: andrea.mayer, davem, edumazet, kuba, pabeni, hangbin.liu, horms,
	david.lebrun, netdev, linux-kernel, stable

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 21 Sep 2026 04:40:25 +0000 you wrote:
> In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> maximum payload length and permits shorter payloads (e.g., 0 bytes).
> When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> skb->head memory, which is stored in sdata->tun_src and leaked back to
> userspace via SEG6_CMD_GET_TUNSRC.
> 
> [...]

Here is the summary with links:
  - [net,v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
    https://git.kernel.org/netdev/net/c/2d959c75c27f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2026-09-24  1:41 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <aq-E5MPYZS5s9_bk@fedora>
2026-09-21  4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
2026-09-21  6:34   ` Hangbin Liu
2026-09-21 22:07   ` Justin Iurman
2026-09-23 22:52   ` Andrea Mayer
2026-09-24  1:34   ` Jakub Kicinski
2026-09-24  1:40   ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox