Commit 329611aa authored by Ido Schimmel's avatar Ido Schimmel Committed by Wen Zhiwei
Browse files

ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family 

stable inclusion
from stable-v6.6.55
commit f989162f55ed238b0495484d645d8b54c2db7838
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB0MX4

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f989162f55ed238b0495484d645d8b54c2db7838

--------------------------------

[ Upstream commit 8fed54758cd248cd311a2b5c1e180abef1866237 ]

The NETLINK_FIB_LOOKUP netlink family can be used to perform a FIB
lookup according to user provided parameters and communicate the result
back to user space.

However, unlike other users of the FIB lookup API, the upper DSCP bits
and the ECN bits of the DS field are not masked, which can result in the
wrong result being returned.

Solve this by masking the upper DSCP bits and the ECN bits using
IPTOS_RT_MASK.

The structure that communicates the request and the response is not
exported to user space, so it is unlikely that this netlink family is
actually in use [1].

[1] https://lore.kernel.org/netdev/ZpqpB8vJU%2FQ6LSqa@debian/



Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
Reviewed-by: default avatarGuillaume Nault <gnault@redhat.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 032faf5c

net/ipv4/fib_frontend.c

+1 −1
Original line number Diff line number Diff line
@@ -1343,7 +1343,7 @@ static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn) 
	struct flowi4           fl4 = {

		.flowi4_mark = frn->fl_mark,

		.daddr = frn->fl_addr,

		.flowi4_tos = frn->fl_tos,

		.flowi4_tos = frn->fl_tos & IPTOS_RT_MASK,

		.flowi4_scope = frn->fl_scope,

	};

	struct fib_table *tb;