bb986a5042
The seg6_validate_srh() is used to validate SRH for three cases:
case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
Case2: SRH of the netlink message received from user-space (iproute2)
Case3: SRH injected into packets through setsockopt
In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
carried in DA only and not represented as SID in the SRH) and the
seg6_validate_srh() now handles this case correctly.
In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
otherwise we lose the first segment (i.e., the first hop).
The current implementation of the seg6_validate_srh() allow SRH of case2
and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
problem.
This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
reduced while preventing SRH of case2 and case3 from being reduced .
Reported-by: syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com
Reported-by: YueHaibing <yuehaibing@huawei.com>
Fixes: 0cb7498f23 ("seg6: fix SRH processing to comply with RFC8754")
Signed-off-by: Ahmed Abdelsalam <ahabdels@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
67 lines
1.6 KiB
C
67 lines
1.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* SR-IPv6 implementation
|
|
*
|
|
* Author:
|
|
* David Lebrun <david.lebrun@uclouvain.be>
|
|
*/
|
|
|
|
#ifndef _NET_SEG6_H
|
|
#define _NET_SEG6_H
|
|
|
|
#include <linux/net.h>
|
|
#include <linux/ipv6.h>
|
|
#include <linux/seg6.h>
|
|
#include <linux/rhashtable-types.h>
|
|
|
|
static inline void update_csum_diff4(struct sk_buff *skb, __be32 from,
|
|
__be32 to)
|
|
{
|
|
__be32 diff[] = { ~from, to };
|
|
|
|
skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
|
|
}
|
|
|
|
static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from,
|
|
__be32 *to)
|
|
{
|
|
__be32 diff[] = {
|
|
~from[0], ~from[1], ~from[2], ~from[3],
|
|
to[0], to[1], to[2], to[3],
|
|
};
|
|
|
|
skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
|
|
}
|
|
|
|
struct seg6_pernet_data {
|
|
struct mutex lock;
|
|
struct in6_addr __rcu *tun_src;
|
|
#ifdef CONFIG_IPV6_SEG6_HMAC
|
|
struct rhashtable hmac_infos;
|
|
#endif
|
|
};
|
|
|
|
static inline struct seg6_pernet_data *seg6_pernet(struct net *net)
|
|
{
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
return net->ipv6.seg6_data;
|
|
#else
|
|
return NULL;
|
|
#endif
|
|
}
|
|
|
|
extern int seg6_init(void);
|
|
extern void seg6_exit(void);
|
|
extern int seg6_iptunnel_init(void);
|
|
extern void seg6_iptunnel_exit(void);
|
|
extern int seg6_local_init(void);
|
|
extern void seg6_local_exit(void);
|
|
|
|
extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced);
|
|
extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
|
|
int proto);
|
|
extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh);
|
|
extern int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr,
|
|
u32 tbl_id);
|
|
#endif
|