[PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc()

[PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc()

[Hui Peng]

seg6_genl_policy[SEG6_ATTR_DST] uses NLA_BINARY with
.len = sizeof(struct in6_addr), which only caps the maximum attribute
length and allows 0-byte SEG6_ATTR_DST attributes.

seg6_genl_set_tunsrc() then unconditionally copies
sizeof(struct in6_addr) (16 bytes) from
nla_data(info->attrs[SEG6_ATTR_DST]) into sdata->tun_src via kmemdup(),
reading 16 bytes of uninitialized skb->head heap memory past skb->tail
and exposing it to userspace via SEG6_CMD_GET_TUNSRC.

Enforce NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) in
seg6_genl_policy and validate nla_len(info->attrs[SEG6_ATTR_DST]) in
seg6_genl_set_tunsrc().

Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -138,8 +138,8 @@ out:
 static struct genl_family seg6_genl_family;
 
 static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
-	[SEG6_ATTR_DST]				= { .type = NLA_BINARY,
-		.len = sizeof(struct in6_addr) },
+	[SEG6_ATTR_DST]				=
+		NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
 	[SEG6_ATTR_DSTLEN]			= { .type = NLA_S32, },
 	[SEG6_ATTR_HMACKEYID]		= { .type = NLA_U32, },
 	[SEG6_ATTR_SECRET]			= { .type = NLA_BINARY, },
@@ -242,7 +242,8 @@ static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
 
 	sdata = seg6_pernet(net);
 
-	if (!info->attrs[SEG6_ATTR_DST])
+	if (!info->attrs[SEG6_ATTR_DST] ||
+	    nla_len(info->attrs[SEG6_ATTR_DST]) != sizeof(struct in6_addr))
 		return -EINVAL;
 
 	val = nla_data(info->attrs[SEG6_ATTR_DST]);
-- 
2.43.0

Re: [PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc()

[Hangbin Liu]

Hi Hui Peng,
On Sat, Sep 19, 2026 at 08:48:06PM +0000, Hui Peng wrote:
> seg6_genl_policy[SEG6_ATTR_DST] uses NLA_BINARY with
> .len = sizeof(struct in6_addr), which only caps the maximum attribute
> length and allows 0-byte SEG6_ATTR_DST attributes.
> 
> seg6_genl_set_tunsrc() then unconditionally copies
> sizeof(struct in6_addr) (16 bytes) from
> nla_data(info->attrs[SEG6_ATTR_DST]) into sdata->tun_src via kmemdup(),
> reading 16 bytes of uninitialized skb->head heap memory past skb->tail
> and exposing it to userspace via SEG6_CMD_GET_TUNSRC.
> 
> Enforce NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) in
> seg6_genl_policy and validate nla_len(info->attrs[SEG6_ATTR_DST]) in
> seg6_genl_set_tunsrc().
> 
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -138,8 +138,8 @@ out:
>  static struct genl_family seg6_genl_family;
>  
>  static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
> -	[SEG6_ATTR_DST]				= { .type = NLA_BINARY,
> -		.len = sizeof(struct in6_addr) },
> +	[SEG6_ATTR_DST]				=
> +		NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),

After you setting the policy here.

>  	[SEG6_ATTR_DSTLEN]			= { .type = NLA_S32, },
>  	[SEG6_ATTR_HMACKEYID]		= { .type = NLA_U32, },
>  	[SEG6_ATTR_SECRET]			= { .type = NLA_BINARY, },
> @@ -242,7 +242,8 @@ static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
>  
>  	sdata = seg6_pernet(net);
>  
> -	if (!info->attrs[SEG6_ATTR_DST])
> +	if (!info->attrs[SEG6_ATTR_DST] ||
> +	    nla_len(info->attrs[SEG6_ATTR_DST]) != sizeof(struct in6_addr))
>  		return -EINVAL;

There is not need to re-check the length again.

Thanks
Hangbin