netdev - Re: [PATCH net-next v2] ipv6: sr: validate HMAC algorithm ID in seg6_genl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250813071758.123403-1-kuniyu@google.com>
Date: Wed, 13 Aug 2025 07:17:35 +0000
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: heminhong@...inos.cn
Cc: dsahern@...nel.org, edumazet@...gle.com, idosch@...sch.org, 
	kuba@...nel.org, kuniyu@...gle.com, netdev@...r.kernel.org, pabeni@...hat.com
Subject: Re: [PATCH net-next v2] ipv6: sr: validate HMAC algorithm ID in seg6_genl_sethmac

From: heminhong <heminhong@...inos.cn>
Date: Wed, 13 Aug 2025 14:57:37 +0800
> From: Minhong He <heminhong@...inos.cn>
> 
> The seg6_genl_sethmac() directly uses the algorithm ID provided by the
> userspace without verifying whether it is an HMAC algorithm supported
> by the system.
> If an unsupported HMAC algorithm ID is configured, packets using SRv6 HMAC
> will be dropped during encapsulation or decapsulation.
> 
> Fixes: 4f4853dc1c9c ("ipv6: sr: implement API to control SR HMAC structure")
> 

nit: no newline here.

> Signed-off-by: Minhong He <heminhong@...inos.cn>
> ---
>  include/net/seg6_hmac.h | 1 +
>  net/ipv6/seg6.c         | 5 +++++
>  net/ipv6/seg6_hmac.c    | 2 +-
>  3 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/seg6_hmac.h b/include/net/seg6_hmac.h
> index 24f733b3e3fe..c34e86c99de3 100644
> --- a/include/net/seg6_hmac.h
> +++ b/include/net/seg6_hmac.h
> @@ -49,6 +49,7 @@ extern int seg6_hmac_info_del(struct net *net, u32 key);
>  extern int seg6_push_hmac(struct net *net, struct in6_addr *saddr,
>  			  struct ipv6_sr_hdr *srh);
>  extern bool seg6_hmac_validate_skb(struct sk_buff *skb);
> +extern struct seg6_hmac_algo *__hmac_get_algo(u8 alg_id);

nit: extern is old fashioned and should be unnecessary.

https://www.kernel.org/doc/html/latest/process/coding-style.html#function-prototypes
---8<---
Do not use the extern keyword with function declarations as this
makes lines longer and isn’t strictly necessary.
---8<---


Also please follow this next time:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html#resending-after-review
---8<---
The new version of patches should be posted as a separate thread,
not as a reply to the previous posting. Change log should include
a link to the previous posting
---8<---