From 41c4d3b26f5e23609cd4b5ca561a399a097daabe Mon Sep 17 00:00:00 2001 From: David Ahern Date: Wed, 13 May 2026 10:50:24 -0600 Subject: [PATCH] xfrm: Reject excessive values for XFRMA_TFCPAD tfcpad is a u32, but that full range is excessive for padding. Limit it to max IP length (64k). Signed-off-by: David Ahern Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_user.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index ae144d1e4a65..e87f33aaa99c 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -937,8 +937,14 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, attrs[XFRMA_ALG_COMP], extack))) goto error; - if (attrs[XFRMA_TFCPAD]) + if (attrs[XFRMA_TFCPAD]) { x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); + if (x->tfcpad > IP_MAX_MTU) { + NL_SET_ERR_MSG(extack, "Excessive TFC padding"); + err = -EINVAL; + goto error; + } + } xfrm_mark_get(attrs, &x->mark);