diff options
| author | Chris Mason <mason@kernel.org> | 2026-11-01 19:05:24 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-11-02 00:10:39 +0000 |
| commit | 58e39f8d58b141b96c030008a20dde9d625ec997 (patch) | |
| tree | 654e2fccfb06ea62f418da60c361cf2f2379a942 /scripts/basic/split-include.c | |
| parent | 6d8118937ba477e03fa2e94e9bd9abac7291a2a2 (diff) | |
| download | linux-58e39f8d58b141b96c030008a20dde9d625ec997.tar.gz linux-58e39f8d58b141b96c030008a20dde9d625ec997.zip | |
bpf: Reject non-IPv6 packets in BPF_LWT_ENCAP_SEG6
The mode BPF_LWT_ENCAP_SEG6 of bpf_lwt_push_encap() pushes an IPv6 header
and an SRH, and it replaces the dst. The SRH says that IPv6 follows, and
skb->protocol does not change. Thus the mode assumes an IPv6 packet, but an
lwt_in prog also runs for IPv4 packets. After the prog, bpf_input() calls
orig_input() of the old dst. This IPv4 handler reads the pushed headers as
IPv4. It can write after the packet data, and the kernel crashes.
after the push orig_input() expects
--------------------- --------------------
skb->protocol ETH_P_IP ETH_P_IP
dst rt6_info rtable
packet | IPv6 | SRH | IPv4 | | IPv4 |
The mode BPF_LWT_ENCAP_SEG6_INLINE returns -EBADMSG for non-IPv6 packets.
Apply this check to both modes. End.BPF does not change, because
seg6_local_input() drops non-IPv6 packets.
Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261101190535.1454146-17-alexei.starovoitov@gmail.com
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions