Files
linux/include/net
Qanux 6db8b56eed ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
On the receive path, __ioam6_fill_trace_data() uses trace->nodelen
to decide how much data to write for each node. It trusts this field
as-is from the incoming packet, with no consistency check against
trace->type (the 24-bit field that tells which data items are
present). A crafted packet can set nodelen=0 while setting type bits
0-21, causing the function to write ~100 bytes past the allocated
region (into skb_shared_info), which corrupts adjacent heap memory
and leads to a kernel panic.

Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to
derive the expected nodelen from the type field, and use it:

  - in ioam6_iptunnel.c (send path, existing validation) to replace
    the open-coded computation;
  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose
    nodelen is inconsistent with the type field, before any data is
    written.

Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they
are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to
0xff1ffc00).

Fixes: 9ee11f0fff ("ipv6: ioam: Data plane support for Pre-allocated Trace")
Cc: stable@vger.kernel.org
Signed-off-by: Junxi Qian <qjx1298677004@gmail.com>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260211040412.86195-1-qjx1298677004@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-13 12:24:05 -08:00
..
2025-11-03 16:49:53 +09:00
2024-10-08 15:33:49 -07:00
2026-01-27 10:45:38 +01:00
2025-09-02 15:52:24 -07:00
2025-11-03 17:40:46 -08:00
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-01-27 10:45:38 +01:00
2022-08-09 22:14:02 -07:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2025-09-03 15:16:49 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2026-01-13 10:12:11 +01:00
2024-08-26 09:37:23 -07:00
2025-09-22 11:38:43 -07:00
2025-08-26 17:34:31 -07:00
2026-02-06 20:50:13 -08:00
2024-12-06 17:43:08 -08:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2025-04-15 08:21:46 -07:00
2023-07-14 20:39:30 -07:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-09-03 15:08:20 -07:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2025-04-11 18:58:10 -07:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2023-10-04 11:49:20 -07:00
2026-02-06 20:12:11 -08:00
2025-07-11 11:00:57 -07:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2026-01-06 17:06:03 -08:00
2023-09-14 16:16:36 +02:00
2026-02-10 20:21:48 -08:00