[PATCH] xfrm: validate protocol for XFRM_MODE_ROUTEOPTIMIZATION in verify_newsa_info()

[PATCH] xfrm: validate protocol for XFRM_MODE_ROUTEOPTIMIZATION in verify_newsa_info()

[Hui Peng]

In verify_newsa_info(), XFRM_MODE_ROUTEOPTIMIZATION skips the protocol
switch validation, allowing IPPROTO_ESP, IPPROTO_AH, or IPPROTO_COMP states
to be created with XFRM_MODE_ROUTEOPTIMIZATION even though only
IPPROTO_DSTOPTS and IPPROTO_ROUTING are valid IPv6 route optimization
protocols. Enforce that XFRM_MODE_ROUTEOPTIMIZATION is only used with
AF_INET6 and IPPROTO_DSTOPTS or IPPROTO_ROUTING.

Fixes: 060f02a3bdd4 ("[XFRM] STATE: Introduce care-of address.")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e796b..2be800232847 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -698,7 +705,9 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
 		NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found");
 		return -ENOSYS;
 	}
-	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) {
+	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits ||
+	    (ualg->alg_trunc_len & 7) ||
+	    (ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32)) {
 		NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV");
 		return -EINVAL;
 	}