Just realized I messed up the justification about sr_has_hmac. The branch will be taken, but its execution will not complete since the TLV's len and type fields aren't copied, hence seg6_get_tlv_hmac will fail, and the HMAC will not be computed.
2018-01-07 17:12 GMT+00:00 Mathieu Xhonneux <m.xhonn...@gmail.com>: > Function ipv6_push_rthdr4 allows to add an IPv6 Segment Routing Header > to a socket through setsockopt, but the current implementation doesn't > copy possible TLVs at the end of the SRH (i.e., the following branch > if (sr_has_hmac(sr_phdr)) will never be taken as no HMAC TLV is copied). > > This commit adds a memcpy in case TLVs have been appended to the SRH. > > Fixes: a149e7c7ce812561f0fdc7a86ddc42f294e5eb3e ("ipv6: sr: add > support for SRH injection through setsockopt") > Acked-by: David Lebrun <dleb...@google.com> > Signed-off-by: Mathieu Xhonneux <m.xhonn...@gmail.com> > --- > net/ipv6/exthdrs.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c > index 83bd75713535..bc68eb661970 100644 > --- a/net/ipv6/exthdrs.c > +++ b/net/ipv6/exthdrs.c > @@ -925,6 +925,15 @@ static void ipv6_push_rthdr4(struct sk_buff *skb, u8 > *proto, > sr_phdr->segments[0] = **addr_p; > *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left]; > > + if (sr_ihdr->hdrlen > hops * 2) { > + int tlvs_offset, tlvs_length; > + > + tlvs_offset = (1 + hops * 2) << 3; > + tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3; > + memcpy((char *)sr_phdr + tlvs_offset, > + (char *)sr_ihdr + tlvs_offset, tlvs_length); > + } > + > #ifdef CONFIG_IPV6_SEG6_HMAC > if (sr_has_hmac(sr_phdr)) { > struct net *net = NULL; > -- > 2.15.1 >