]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
authorIdo Schimmel <idosch@nvidia.com>
Wed, 14 Aug 2024 12:52:22 +0000 (15:52 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Oct 2024 13:11:26 +0000 (15:11 +0200)
commitfb55f3d88fe1d82c826eb9cb7af4a15fbdf5b4ab
tree67f598e91bacde4ca0d3c9d4a11e047b1ad76130
parentbabfc87445bf6ba9d9e6dadac39fabcb13050a57
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family

[ Upstream commit 8fed54758cd248cd311a2b5c1e180abef1866237 ]

The NETLINK_FIB_LOOKUP netlink family can be used to perform a FIB
lookup according to user provided parameters and communicate the result
back to user space.

However, unlike other users of the FIB lookup API, the upper DSCP bits
and the ECN bits of the DS field are not masked, which can result in the
wrong result being returned.

Solve this by masking the upper DSCP bits and the ECN bits using
IPTOS_RT_MASK.

The structure that communicates the request and the response is not
exported to user space, so it is unlikely that this netlink family is
actually in use [1].

[1] https://lore.kernel.org/netdev/ZpqpB8vJU%2FQ6LSqa@debian/

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/fib_frontend.c