ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add

[ Upstream commit 84967deee9d9870b15bc4c3acb50f1d401807902 ]

The seg6_genl_sethmac() directly uses the algorithm ID provided by the
userspace without verifying whether it is an HMAC algorithm supported
by the system.
If an unsupported HMAC algorithm ID is configured, packets using SRv6 HMAC
will be dropped during encapsulation or decapsulation.

Fixes: 4f4853dc1c9c ("ipv6: sr: implement API to control SR HMAC structure")
Signed-off-by: Minhong He <heminhong@kylinos.cn>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250815063845.85426-1-heminhong@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index 22a5006ad34a8c10f9ad4d0be6cec8e2043ff86a..6e15a65faeccd70515b1ea4631de77429b3f66bb 100644 (file)
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -294,6 +294,9 @@ int seg6_hmac_info_add(struct net *net, u32 key, struct seg6_hmac_info *hinfo)
        struct seg6_pernet_data *sdata = seg6_pernet(net);
        int err;
 
+       if (!__hmac_get_algo(hinfo->alg_id))
+               return -EINVAL;
+
        err = rhashtable_lookup_insert_fast(&sdata->hmac_infos, &hinfo->node,
                                            rht_params);