Skip to content

pathd: prevent stack buffer overflow in path_zebra_add_sr_policy() #22441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guoguojia2021 wants to merge 1 commit into
base: master
Choose a base branch
from
+7 −1
Open

pathd: prevent stack buffer overflow in path_zebra_add_sr_policy() #22441

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion pathd/path_zebra.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,9 +184,15 @@ void path_zebra_add_sr_policy(struct srte_policy *policy,
zp.segment_list.type = ZEBRA_LSP_SRTE;
zp.segment_list.local_label = policy->binding_sid;
zp.segment_list.label_num = 0;
RB_FOREACH (segment, srte_segment_entry_head, &segment_list->segments)
RB_FOREACH (segment, srte_segment_entry_head, &segment_list->segments) {
if (zp.segment_list.label_num >= MPLS_MAX_LABELS) {
zlog_warn("SR-TE policy %s: segment list exceeds MPLS_MAX_LABELS (%d), truncating",
policy->name, MPLS_MAX_LABELS);
break;
}
zp.segment_list.labels[zp.segment_list.label_num++] =
segment->sid_value;
}
policy->status = SRTE_POLICY_STATUS_GOING_UP;

(void)zebra_send_sr_policy(pathd_zclient, ZEBRA_SR_POLICY_SET, &zp);
Comment on lines +188 to 198

@greptile-apps greptile-apps Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Truncated policy sent to Zebra with incomplete segment list

When the segment list exceeds MPLS_MAX_LABELS, this code truncates the label stack and still calls zebra_send_sr_policy() with only the first 16 labels. Sending an incomplete segment list to the forwarding plane installs an SR-TE policy with a shorter stack than what was signaled, which will misroute or black-hole traffic at the first transit node that expects the full label stack. The original policy intent is not achievable with a partial label stack, so it may be safer to abort the install entirely (log the warning, skip the zebra_send_sr_policy call, and return) rather than silently forwarding with a truncated path.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pathd/path_zebra.c
Line: 188-198

Comment:
**Truncated policy sent to Zebra with incomplete segment list**

When the segment list exceeds `MPLS_MAX_LABELS`, this code truncates the label stack and still calls `zebra_send_sr_policy()` with only the first 16 labels. Sending an incomplete segment list to the forwarding plane installs an SR-TE policy with a shorter stack than what was signaled, which will misroute or black-hole traffic at the first transit node that expects the full label stack. The original policy intent is not achievable with a partial label stack, so it may be safer to abort the install entirely (log the warning, skip the `zebra_send_sr_policy` call, and return) rather than silently forwarding with a truncated path.

How can I resolve this? If you propose a fix, please make it concise.

@riw777 riw777 Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks valid?

Expand Down
Loading