seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds

The seg6_validate_srh() is used to validate SRH for three cases:

case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
Case2: SRH of the netlink message received  from user-space (iproute2)
Case3: SRH injected into packets through setsockopt

In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
carried in DA only and not represented as SID in the SRH) and the
seg6_validate_srh() now handles this case correctly.

In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
otherwise we lose the first segment (i.e., the first hop).

The current implementation of the seg6_validate_srh() allow SRH of case2
and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
problem.

This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
reduced while preventing SRH of case2 and case3 from being reduced .

Reported-by: syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com
Reported-by: YueHaibing <yuehaibing@huawei.com>
Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754")
Signed-off-by: Ahmed Abdelsalam <ahabdels@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/seg6.h b/include/net/seg6.h
index 640724b352731487d2d079c75db12c11ee65dd79..9d19c15e8545c21334f6c3ecbb2a5be55758ae14 100644 (file)
--- a/include/net/seg6.h
+++ b/include/net/seg6.h
@@ -57,7 +57,7 @@ extern void seg6_iptunnel_exit(void);
 extern int seg6_local_init(void);
 extern void seg6_local_exit(void);
 
-extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len);
+extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced);
 extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
                             int proto);
 extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh);

diff --git a/net/core/filter.c b/net/core/filter.c
index d01a244b5087af8313bbe905a7ca77aceb1a5aaa..209482a4eaa252b9694ee10d9e187b23586a5f7f 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5050,7 +5050,7 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len
        int err;
        struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)hdr;
 
-       if (!seg6_validate_srh(srh, len))
+       if (!seg6_validate_srh(srh, len, false))
                return -EINVAL;
 
        switch (type) {

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 2c843ff5e3a92d8489a2e920129eed4984aba11b..20576e87a5f7e87b99d6fbd5370771738b3a52e0 100644 (file)
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -493,7 +493,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                                struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)
                                                          opt->srcrt;
 
-                               if (!seg6_validate_srh(srh, optlen))
+                               if (!seg6_validate_srh(srh, optlen, false))
                                        goto sticky_done;
                                break;
                        }

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 37b434293bda3bb1986e4c0c09362473c11db179..d2f8138e5a73a5391963659be446f58f50d9d78e 100644 (file)
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -25,7 +25,7 @@
 #include <net/seg6_hmac.h>
 #endif
 
-bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
+bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced)
 {
        unsigned int tlv_offset;
        int max_last_entry;
@@ -37,13 +37,17 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
        if (((srh->hdrlen + 1) << 3) != len)
                return false;
 
-       max_last_entry = (srh->hdrlen / 2) - 1;
-
-       if (srh->first_segment > max_last_entry)
+       if (!reduced && srh->segments_left > srh->first_segment) {
                return false;
+       } else {
+               max_last_entry = (srh->hdrlen / 2) - 1;
 
-       if (srh->segments_left > srh->first_segment + 1)
-               return false;
+               if (srh->first_segment > max_last_entry)
+                       return false;
+
+               if (srh->segments_left > srh->first_segment + 1)
+                       return false;
+       }
 
        tlv_offset = sizeof(*srh) + ((srh->first_segment + 1) << 4);
 

diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index c7cbfeae94f5eb8cbbe73a07bf30875fbb69cd84..e0e9f48ab14fef940655729c12742f1b9ccdb23e 100644 (file)
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -426,7 +426,7 @@ static int seg6_build_state(struct net *net, struct nlattr *nla,
        }
 
        /* verify that SRH is consistent */
-       if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo)))
+       if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo), false))
                return -EINVAL;
 
        newts = lwtunnel_state_alloc(tuninfo_len + sizeof(*slwt));

diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
index 52493423f32992f2578a4e29cbe8ac6a5e4c2299..eba23279912df7f326ff8c4b977158f3df9f55d7 100644 (file)
--- a/net/ipv6/seg6_local.c
+++ b/net/ipv6/seg6_local.c
@@ -87,7 +87,7 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb)
         */
        srh = (struct ipv6_sr_hdr *)(skb->data + srhoff);
 
-       if (!seg6_validate_srh(srh, len))
+       if (!seg6_validate_srh(srh, len, true))
                return NULL;
 
        return srh;
@@ -495,7 +495,7 @@ bool seg6_bpf_has_valid_srh(struct sk_buff *skb)
                        return false;
 
                srh->hdrlen = (u8)(srh_state->hdrlen >> 3);
-               if (!seg6_validate_srh(srh, (srh->hdrlen + 1) << 3))
+               if (!seg6_validate_srh(srh, (srh->hdrlen + 1) << 3, true))
                        return false;
 
                srh_state->valid = true;
@@ -670,7 +670,7 @@ static int parse_nla_srh(struct nlattr **attrs, struct seg6_local_lwt *slwt)
        if (len < sizeof(*srh) + sizeof(struct in6_addr))
                return -EINVAL;
 
-       if (!seg6_validate_srh(srh, len))
+       if (!seg6_validate_srh(srh, len, false))
                return -EINVAL;
 
        slwt->srh = kmemdup(srh, len, GFP_KERNEL);