Re: [PATCH net v4] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

[Hangbin Liu]

Hi Andrea,
On Thu, Sep 24, 2026 at 06:00:16PM +0200, Andrea Mayer wrote:
> On Thu, 24 Sep 2026 09:36:10 +0000
> Hui Peng <benquike@xxxxxxxxx> wrote:
> 
> > In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> > .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> > maximum payload length and permits shorter payloads (e.g., 0 bytes).
> > When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> > kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> > triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> > skb->head memory, which is stored in sdata->tun_src and leaked back to
> > userspace via SEG6_CMD_GET_TUNSRC.
> > 
> > Switch SEG6_ATTR_DST in seg6_genl_policy to
> > NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
> > validation rejects any attribute whose length is not exactly
> > sizeof(struct in6_addr) with -ERANGE.
> > 
> > Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
> > Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
> > by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
> > succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
> > uninitialized kernel heap memory; with this patch applied,
> > SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
> > -ERANGE (-34) and tun_src remains zeroed.
> > 
> > Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Reviewed-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
> > Reviewed-by: Hangbin Liu <hangbin.liu@xxxxxxxxx>
> > Reviewed-by: Breno Leitao <leitao@xxxxxxxxxx>
> > Assisted-by: LLM
> > Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> > ---
> > Changes in v4:
> > - Drop raw hex memory dump string from commit message as suggested by Breno
> >   Leitao.
> > - Add Reviewed-by tag from Breno Leitao.
> > 
> > Changes in v3:
> > - Add Reviewed-by tag from Andrea Mayer.
> > - Send as a fresh standalone thread (no In-Reply-To header) as requested by
> >   Jakub Kicinski.
> > 
> > Changes in v2:
> > - Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
> >   sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
> >   NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
> >   length, as pointed out by Hangbin Liu.
> > 
> >  net/ipv6/seg6.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> 
> The v2 was applied to netdev/net.git (main) as commit 2d959c75c27f
> ("ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST"):
> 
> https://git.kernel.org/netdev/net/c/2d959c75c27f90e9ec489d18ce5ee6b852ad4741
> 
> One general note for your future postings, not about this patch which is
> already applied: please do not repost a patch less than 24 hours after
> the previous posting. See the "Resending after review" section of
> Documentation/process/maintainer-netdev.rst:
> 
> https://docs.kernel.org/process/maintainer-netdev.html#resending-after-review

It looks like this is a bot sending the patches. It never replies to comments.
When you suggest changes, it just posts a new version directly. For that
reason, I've stopped reviewing its patches.

Thanks
Hangbin