[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[PATCH net 0/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

ipv6_chk_rpl_srh_loop() misses the shortest RPL loop pattern containing
two local addresses with a non-local address between them. The check is
made before the current local address is counted, so found is 1 rather
than greater than 1 when the second local address is reached.

Patch 1 fixes the condition. Patch 2 adds a selftest which verifies that
adjacent local addresses are accepted and separated local addresses are
rejected.

The selftest fails on the unmodified net tree and passes with the fix.

Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
---
Mark Amirkan (2):
      ipv6: rpl: fix loop detection for separated local addresses
      selftests: net: add RPL SRH loop test

 net/ipv6/addrconf.c                         |  2 +-
 tools/testing/selftests/net/Makefile        |  1 +
 tools/testing/selftests/net/rpl_srh_loop.sh | 38 +++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
---
base-commit: 78445023439506ebd83b86d40b1e428a3b309d4a
change-id: 20260911-sympwn-rpl-send-c739b4c864a7

Best regards,
--  
Mark Amirkan <markdamirkan@gmail.com>

[PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

RFC 6554 requires an RPL router to drop a packet when two or more
addresses assigned to the router are separated in the SRH by an address
not assigned to it.

ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
local address. For the shortest invalid sequence -- local, non-local,
local -- found is 1 at the second local address and the SRH is accepted.

Check whether a local address was seen before the separation instead.
The receive path calls this helper before forwarding an RPL SRH, and
RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.

Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
Cc: stable@vger.kernel.org
Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
Assisted-by: Symbolic
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9d89be7e0544..f678fb7fa574 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4621,7 +4621,7 @@ int ipv6_chk_rpl_srh_loop(struct net *net, const struct in6_addr *segs,
 		}
 
 		if (hash_found) {
-			if (found > 1 && separated) {
+			if (found && separated) {
 				ret = 1;
 				break;
 			}

-- 
2.43.0

Re: [PATCH net 1/2] ipv6: rpl: fix loop detection for separated local addresses

[Ido Schimmel]

On Fri, Sep 11, 2026 at 04:11:21PM -0700, Mark Amirkan via B4 Relay wrote:
> From: Mark Amirkan <markdamirkan@gmail.com>
> 
> RFC 6554 requires an RPL router to drop a packet when two or more
> addresses assigned to the router are separated in the SRH by an address
> not assigned to it.
> 
> ipv6_chk_rpl_srh_loop() checks found > 1 before counting the current
> local address. For the shortest invalid sequence -- local, non-local,
> local -- found is 1 at the second local address and the SRH is accepted.
> 
> Check whether a local address was seen before the separation instead.
> The receive path calls this helper before forwarding an RPL SRH, and
> RFC 6554 requires the check to mitigate bandwidth-exhaustion attacks.
> 
> Fixes: f37c60593634 ("addrconf: add functionality to check on rpl requirements")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
> Assisted-by: Symbolic

Code looks fine, but your SoB should be the last tag. Also, if
"Symbolic" is an LLM, then please use:

Assisted-by: LLM

See:

https://docs.kernel.org/next/process/coding-assistants.html#attribution
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=816d9992d9ed434ec52cfbd63080d518e535a41b