* [PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc()
@ 2026-09-19 20:48 Hui Peng
2026-09-20 7:01 ` Hangbin Liu
0 siblings, 1 reply; 4+ messages in thread
From: Hui Peng @ 2026-09-19 20:48 UTC (permalink / raw)
To: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Simon Horman, netdev, linux-kernel
seg6_genl_policy[SEG6_ATTR_DST] uses NLA_BINARY with
.len = sizeof(struct in6_addr), which only caps the maximum attribute
length and allows 0-byte SEG6_ATTR_DST attributes.
seg6_genl_set_tunsrc() then unconditionally copies
sizeof(struct in6_addr) (16 bytes) from
nla_data(info->attrs[SEG6_ATTR_DST]) into sdata->tun_src via kmemdup(),
reading 16 bytes of uninitialized skb->head heap memory past skb->tail
and exposing it to userspace via SEG6_CMD_GET_TUNSRC.
Enforce NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) in
seg6_genl_policy and validate nla_len(info->attrs[SEG6_ATTR_DST]) in
seg6_genl_set_tunsrc().
Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -138,8 +138,8 @@ out:
static struct genl_family seg6_genl_family;
static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
- [SEG6_ATTR_DST] = { .type = NLA_BINARY,
- .len = sizeof(struct in6_addr) },
+ [SEG6_ATTR_DST] =
+ NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
[SEG6_ATTR_DSTLEN] = { .type = NLA_S32, },
[SEG6_ATTR_HMACKEYID] = { .type = NLA_U32, },
[SEG6_ATTR_SECRET] = { .type = NLA_BINARY, },
@@ -242,7 +242,8 @@ static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
sdata = seg6_pernet(net);
- if (!info->attrs[SEG6_ATTR_DST])
+ if (!info->attrs[SEG6_ATTR_DST] ||
+ nla_len(info->attrs[SEG6_ATTR_DST]) != sizeof(struct in6_addr))
return -EINVAL;
val = nla_data(info->attrs[SEG6_ATTR_DST]);
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc()
2026-09-19 20:48 [PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc() Hui Peng
@ 2026-09-20 7:01 ` Hangbin Liu
2026-09-21 4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
0 siblings, 1 reply; 4+ messages in thread
From: Hangbin Liu @ 2026-09-20 7:01 UTC (permalink / raw)
To: Hui Peng
Cc: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netdev, linux-kernel
Hi Hui Peng,
On Sat, Sep 19, 2026 at 08:48:06PM +0000, Hui Peng wrote:
> seg6_genl_policy[SEG6_ATTR_DST] uses NLA_BINARY with
> .len = sizeof(struct in6_addr), which only caps the maximum attribute
> length and allows 0-byte SEG6_ATTR_DST attributes.
>
> seg6_genl_set_tunsrc() then unconditionally copies
> sizeof(struct in6_addr) (16 bytes) from
> nla_data(info->attrs[SEG6_ATTR_DST]) into sdata->tun_src via kmemdup(),
> reading 16 bytes of uninitialized skb->head heap memory past skb->tail
> and exposing it to userspace via SEG6_CMD_GET_TUNSRC.
>
> Enforce NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) in
> seg6_genl_policy and validate nla_len(info->attrs[SEG6_ATTR_DST]) in
> seg6_genl_set_tunsrc().
>
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -138,8 +138,8 @@ out:
> static struct genl_family seg6_genl_family;
>
> static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
> - [SEG6_ATTR_DST] = { .type = NLA_BINARY,
> - .len = sizeof(struct in6_addr) },
> + [SEG6_ATTR_DST] =
> + NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
After you setting the policy here.
> [SEG6_ATTR_DSTLEN] = { .type = NLA_S32, },
> [SEG6_ATTR_HMACKEYID] = { .type = NLA_U32, },
> [SEG6_ATTR_SECRET] = { .type = NLA_BINARY, },
> @@ -242,7 +242,8 @@ static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
>
> sdata = seg6_pernet(net);
>
> - if (!info->attrs[SEG6_ATTR_DST])
> + if (!info->attrs[SEG6_ATTR_DST] ||
> + nla_len(info->attrs[SEG6_ATTR_DST]) != sizeof(struct in6_addr))
> return -EINVAL;
There is not need to re-check the length again.
Thanks
Hangbin
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
2026-09-20 7:01 ` Hangbin Liu
@ 2026-09-21 4:40 ` Hui Peng
2026-09-21 6:34 ` Hangbin Liu
0 siblings, 1 reply; 4+ messages in thread
From: Hui Peng @ 2026-09-21 4:40 UTC (permalink / raw)
To: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Hangbin Liu, Simon Horman, David Lebrun, netdev, linux-kernel,
stable, Hui Peng
In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
.len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
maximum payload length and permits shorter payloads (e.g., 0 bytes).
When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
skb->head memory, which is stored in sdata->tun_src and leaked back to
userspace via SEG6_CMD_GET_TUNSRC.
Switch SEG6_ATTR_DST in seg6_genl_policy to
NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
validation rejects any attribute whose length is not exactly
sizeof(struct in6_addr) with -ERANGE.
Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
uninitialized kernel heap memory (tun_src =
836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
-ERANGE (-34) and tun_src remains zeroed.
Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
length, as pointed out by Hangbin Liu.
net/ipv6/seg6.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 62a7eb779202..8c2b156c227a 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -138,8 +138,8 @@ void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
static struct genl_family seg6_genl_family;
static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
- [SEG6_ATTR_DST] = { .type = NLA_BINARY,
- .len = sizeof(struct in6_addr) },
+ [SEG6_ATTR_DST] =
+ NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
[SEG6_ATTR_DSTLEN] = { .type = NLA_S32, },
[SEG6_ATTR_HMACKEYID] = { .type = NLA_U32, },
[SEG6_ATTR_SECRET] = { .type = NLA_BINARY, },
--
2.49.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
2026-09-21 4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
@ 2026-09-21 6:34 ` Hangbin Liu
0 siblings, 0 replies; 4+ messages in thread
From: Hangbin Liu @ 2026-09-21 6:34 UTC (permalink / raw)
To: Hui Peng
Cc: Andrea Mayer, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Lebrun, netdev, linux-kernel,
stable
On Mon, Sep 21, 2026 at 04:40:25AM +0000, Hui Peng wrote:
> In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
> .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
> maximum payload length and permits shorter payloads (e.g., 0 bytes).
> When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
> kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
> triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
> skb->head memory, which is stored in sdata->tun_src and leaked back to
> userspace via SEG6_CMD_GET_TUNSRC.
>
> Switch SEG6_ATTR_DST in seg6_genl_policy to
> NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
> validation rejects any attribute whose length is not exactly
> sizeof(struct in6_addr) with -ERANGE.
>
> Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
> Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
> by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
> succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
> uninitialized kernel heap memory (tun_src =
> 836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
> SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
> -ERANGE (-34) and tun_src remains zeroed.
>
> Fixes: 915d7e5e5930 ("ipv6: sr: add code base for control plane support of SR-IPv6")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Drop the redundant nla_len(info->attrs[SEG6_ATTR_DST]) !=
> sizeof(struct in6_addr) check in seg6_genl_set_tunsrc() since
> NLA_POLICY_EXACT_LEN() in seg6_genl_policy already enforces the exact
> length, as pointed out by Hangbin Liu.
>
> net/ipv6/seg6.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
> index 62a7eb779202..8c2b156c227a 100644
> --- a/net/ipv6/seg6.c
> +++ b/net/ipv6/seg6.c
> @@ -138,8 +138,8 @@ void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
> static struct genl_family seg6_genl_family;
>
> static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
> - [SEG6_ATTR_DST] = { .type = NLA_BINARY,
> - .len = sizeof(struct in6_addr) },
> + [SEG6_ATTR_DST] =
> + NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
> [SEG6_ATTR_DSTLEN] = { .type = NLA_S32, },
> [SEG6_ATTR_HMACKEYID] = { .type = NLA_U32, },
> [SEG6_ATTR_SECRET] = { .type = NLA_BINARY, },
> --
> 2.49.0
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-21 6:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-19 20:48 [PATCH] ipv6: sr: fix 16-byte kernel heap leak in seg6_genl_set_tunsrc() Hui Peng
2026-09-20 7:01 ` Hangbin Liu
2026-09-21 4:40 ` [PATCH net v2] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST Hui Peng
2026-09-21 6:34 ` Hangbin Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®