netdev - Re: [PATCH net] seg6: fix route leak for encap routes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <364fe528-87a1-4bc3-bcff-7fa73eb9eb44@6wind.com>
Date: Thu, 18 Dec 2025 15:28:42 +0100
From: Nicolas Dichtel <nicolas.dichtel@...nd.com>
To: Paolo Abeni <pabeni@...hat.com>, Andrea Mayer <andrea.mayer@...roma2.it>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski
 <kuba@...nel.org>, Eric Dumazet <edumazet@...gle.com>,
 David Lebrun <david.lebrun@...ouvain.be>,
 Paolo Lungaroni <paolo.lungaroni@...roma2.it>,
 David Ahern <dsahern@...nel.org>, netdev@...r.kernel.org,
 stefano.salsano@...roma2.it
Subject: Re: [PATCH net] seg6: fix route leak for encap routes

Le 18/12/2025 à 11:35, Paolo Abeni a écrit :
> On 12/14/25 2:39 PM, Andrea Mayer wrote:
>> On Wed, 10 Dec 2025 18:00:39 +0100
>> Nicolas Dichtel <nicolas.dichtel@...nd.com> wrote:
>>> Le 10/12/2025 à 11:37, Andrea Mayer a écrit :
>>>> I've got your point. However, I'm still concerned about the implications of
>>>> using the *dev* field in the root lookup. This field has been ignored for this
>>>> purpose so far, so some existing configurations/scripts may need to be adapted
>>>> to work again. The adjustments made to the self-tests below show what might
>>>> happen.
>>> Yes, I was wondering how users use this *dev* arg. Maybe adding a new attribute,
>>> something like SEG6_IPTUNNEL_USE_NH_DEV will avoid any regressions.
>>>
>>
>> IMHO using a new attribute seems to be a safer approach.
I agree.

> 
> Given the functional implication I suggest using a new attribute. Given
> that I also suggest targeting net-next for the next revision of this patch.
I see this as a bug. A route such as
cafe::1  encap seg6 mode encap segs 1 [ fc00:21:100::6046 ] dev veth0
with veth0 completely ignored but mandatory is buggy.

> 
>>>>> diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
>>>>> index 3e1b9991131a..9535aea28357 100644
>>>>> --- a/net/ipv6/seg6_iptunnel.c
>>>>> +++ b/net/ipv6/seg6_iptunnel.c
>>>>> @@ -484,6 +484,12 @@ static int seg6_input_core(struct net *net, struct sock *sk,
>>>>>  	 * now and use it later as a comparison.
>>>>>  	 */
>>>>>  	lwtst = orig_dst->lwtstate;
>>>>> +	if (orig_dst->dev) {
> 
> Here you should probably use dst_dev_rcu(), under the rcu lock, avoiding
> touching dev twice.
Ok.

Thanks,
Nicolas