Ahmed Abdelsalam
86527f07f5
UPSTREAM: seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds ...
The seg6_validate_srh() is used to validate SRH for three cases:
case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
Case2: SRH of the netlink message received from user-space (iproute2)
Case3: SRH injected into packets through setsockopt
In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
carried in DA only and not represented as SID in the SRH) and the
seg6_validate_srh() now handles this case correctly.
In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
otherwise we lose the first segment (i.e., the first hop).
The current implementation of the seg6_validate_srh() allow SRH of case2
and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
problem.
This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
reduced while preventing SRH of case2 and case3 from being reduced .
Reported-by: syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com
Reported-by: YueHaibing <yuehaibing@huawei.com>
Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754")
Change-Id: I2917c075b16c8887f80f74f380e2f26b12d1c19c
Signed-off-by: Ahmed Abdelsalam <ahabdels@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2026-01-14 17:48:10 -08:00
This is the 5.4.279 stable release
2024-07-08 13:55:50 +00:00
netfilter: nf_tables: do not defer rule destruction via call_rcu
2025-06-04 14:32:36 +02:00
UPSTREAM: bpf: Add link-based BPF program attachment to network namespace
2026-01-14 17:48:09 -08:00
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
2025-12-03 12:45:11 +01:00
sctp: detect and prevent references to a freed transport in sendmsg
2025-05-02 07:39:16 +02:00
net: sched: extract qstats update code into functions
2025-08-28 16:21:36 +02:00
This is the 5.4.275 stable release
2024-05-15 16:00:38 +00:00
UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
2024-07-02 13:43:53 +03:00
bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
2023-06-14 10:59:58 +02:00
bonding: fix macvlan over alb bond support
2023-08-30 16:27:24 +02:00
UPSTREAM: bpf: INET_DIAG support in bpf_sk_storage
2025-12-23 13:36:00 -08:00
net: busy-poll: use ktime_get_ns() instead of local_clock()
2024-09-04 13:15:03 +02:00
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-10-08 15:17:54 +03:00
UPSTREAM: bpf: Allow to retrieve cgroup v1 classid from v2 hooks
2025-12-23 13:36:09 -08:00
Merge 5.4.248 into android11-5.4-lts
2023-06-22 16:16:24 +00:00
UPSTREAM: wireguard: device: reset peer src endpoint when netns exits
2025-09-24 12:16:39 +02:00
net: fix __dst_negative_advice() race
2024-06-16 13:28:52 +02:00
erspan: Add type I version 0 support.
2024-04-13 12:51:36 +02:00
Revert "inet: shrink struct flowi_common"
2023-11-27 17:25:07 +00:00
BACKPORT: flow_dissector: Move out netns_bpf prog callbacks
2026-01-14 17:48:08 -08:00
net: extract port range fields from fl_flow_key
2025-03-13 12:43:23 +01:00
Revert "genetlink: hold RCU in genlmsg_mcast()"
2024-11-09 16:39:42 +00:00
net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
2023-12-20 15:41:13 +01:00
UPSTREAM: net: Track socket refcounts in skb_steal_sock()
2025-12-23 13:36:11 -08:00
UPSTREAM: bpf: Allow any port in bpf_bind helper
2025-12-23 13:36:18 -08:00
This is the 5.4.290 stable release
2025-02-05 17:00:16 +00:00
UPSTREAM: net: Track socket refcounts in skb_steal_sock()
2025-12-23 13:36:11 -08:00
Merge 5.4.245 into android11-5.4-lts
2023-06-20 16:54:26 +00:00
UPSTREAM: bpf: Enable bpf_iter targets registering ctx argument types
2026-01-14 17:41:40 -08:00
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2023-05-30 12:44:05 +01:00
Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
2025-12-04 19:21:35 +02:00
tcp: Reduce chance of collisions in inet6_hashfn().
2023-08-11 11:53:47 +02:00
UPSTREAM: net: Refactor arguments of inet{,6}_bind
2025-12-23 13:36:18 -08:00
kcm: Serialise kcm_sendmsg() for the same socket.
2024-09-04 13:14:59 +02:00
vrf: use RCU protection in l3mdev_l3_out()
2025-03-13 12:43:12 +01:00
net: lapb: increase LAPB_HEADER_LEN
2024-12-19 18:05:03 +01:00
llc: Drop support for ETH_P_TR_802_2.
2024-02-23 08:24:50 +01:00
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-23 10:59:42 +02:00
mac80211: Add support to trigger sta disconnect on hardware restart
2024-11-08 16:20:52 +01:00
Merge android11-5.4.249+ ( d57e792) into msm-5.4
2023-09-28 16:45:28 +05:30
UPSTREAM: net: Introduce netns_bpf for BPF programs attached to netns
2026-01-14 17:48:08 -08:00
net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-12-03 12:45:04 +01:00
Revert "net: rtnetlink: add msg kind names"
2025-10-31 07:58:56 +00:00
This is the 5.4.297 stable release
2025-09-02 10:52:40 +00:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
UPSTREAM: seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
2026-01-14 17:48:10 -08:00
BACKPORT: net: Make locking in sock_bindtoindex optional
2026-01-14 17:48:07 -08:00
UPSTREAM: net: Generate reuseport group ID on group creation
2025-12-23 13:35:57 -08:00
BACKPORT: bpf: sockmap: Move generic sockmap hooks from BPF TCP
2025-12-23 13:36:03 -08:00
This is the 5.4.297 stable release
2025-09-02 10:52:40 +00:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
vxlan: calculate correct header length for GPE
2023-08-11 11:53:47 +02:00
BACKPORT: xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame
2026-01-14 17:48:07 -08:00
UPSTREAM: xsk: Move xskmap.c to net/xdp/
2026-01-14 17:48:04 -08:00
This is the 5.4.276 stable release
2024-05-17 15:29:56 +00:00
86527f07f5