]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
seg6: Fix validation of nexthop addresses
authorIdo Schimmel <idosch@nvidia.com>
Wed, 4 Jun 2025 11:32:52 +0000 (14:32 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 19 Jun 2025 13:32:20 +0000 (15:32 +0200)
commitd5d9fd13bc19a3f9f2a951c5b6e934d84205789e
treeacc88f9aa28ca27dc2747c23afa033e16aa3b484
parent933466fc50a8e4eb167acbd0d8ec96a078462e9c
seg6: Fix validation of nexthop addresses

[ Upstream commit 7632fedb266d93ed0ed9f487133e6c6314a9b2d1 ]

The kernel currently validates that the length of the provided nexthop
address does not exceed the specified length. This can lead to the
kernel reading uninitialized memory if user space provided a shorter
length than the specified one.

Fix by validating that the provided length exactly matches the specified
one.

Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250604113252.371528-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv6/seg6_local.c