seg6: Fix validation of nexthop addresses
authorIdo Schimmel <idosch@nvidia.com>
Wed, 4 Jun 2025 11:32:52 +0000 (14:32 +0300)
committerJakub Kicinski <kuba@kernel.org>
Thu, 5 Jun 2025 15:03:17 +0000 (08:03 -0700)
commit7632fedb266d93ed0ed9f487133e6c6314a9b2d1
tree99e2baa92bb667cf9d0f8d78ebb3517376564135
parentfeafc73f3e6ae73371777a037d41d2e31c929636
seg6: Fix validation of nexthop addresses

The kernel currently validates that the length of the provided nexthop
address does not exceed the specified length. This can lead to the
kernel reading uninitialized memory if user space provided a shorter
length than the specified one.

Fix by validating that the provided length exactly matches the specified
one.

Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250604113252.371528-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/seg6_local.c