lkml.org 
[lkml]   [2020]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [net] seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
From
From: Ahmed Abdelsalam <ahabdels@gmail.com>
Date: Wed, 3 Jun 2020 06:54:42 +0000

> The seg6_validate_srh() is used to validate SRH for three cases:
>
> case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
> Case2: SRH of the netlink message received from user-space (iproute2)
> Case3: SRH injected into packets through setsockopt
>
> In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
> carried in DA only and not represented as SID in the SRH) and the
> seg6_validate_srh() now handles this case correctly.
>
> In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
> otherwise we lose the first segment (i.e., the first hop).
>
> The current implementation of the seg6_validate_srh() allow SRH of case2
> and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
> problem.
>
> This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
> reduced while preventing SRH of case2 and case3 from being reduced .
>
> Reported-by: syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com
> Reported-by: YueHaibing <yuehaibing@huawei.com>
> Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754")
> Signed-off-by: Ahmed Abdelsalam <ahabdels@gmail.com>

Applied, thanks.
\
 
 \ /
  Last update: 2020-06-05 00:40    [W:0.127 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site