Skip to content

Commit d5d9fd1

Browse files
idoschgregkh
authored andcommitted
seg6: Fix validation of nexthop addresses
[ Upstream commit 7632fed ] The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel reading uninitialized memory if user space provided a shorter length than the specified one. Fix by validating that the provided length exactly matches the specified one. Fixes: d1df6fd ("ipv6: sr: define core operations for seg6local lightweight tunnel") Reviewed-by: Petr Machata <[email protected]> Signed-off-by: Ido Schimmel <[email protected]> Reviewed-by: David Ahern <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
1 parent 933466f commit d5d9fd1

File tree

1 file changed

+2
-4
lines changed

1 file changed

+2
-4
lines changed

net/ipv6/seg6_local.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1644,10 +1644,8 @@ static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = {
16441644
[SEG6_LOCAL_SRH] = { .type = NLA_BINARY },
16451645
[SEG6_LOCAL_TABLE] = { .type = NLA_U32 },
16461646
[SEG6_LOCAL_VRFTABLE] = { .type = NLA_U32 },
1647-
[SEG6_LOCAL_NH4] = { .type = NLA_BINARY,
1648-
.len = sizeof(struct in_addr) },
1649-
[SEG6_LOCAL_NH6] = { .type = NLA_BINARY,
1650-
.len = sizeof(struct in6_addr) },
1647+
[SEG6_LOCAL_NH4] = NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)),
1648+
[SEG6_LOCAL_NH6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
16511649
[SEG6_LOCAL_IIF] = { .type = NLA_U32 },
16521650
[SEG6_LOCAL_OIF] = { .type = NLA_U32 },
16531651
[SEG6_LOCAL_BPF] = { .type = NLA_NESTED },

0 commit comments

Comments
 (0)