4 files changed, 86 insertions, 7 deletions

diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index d4c1c75b8862..0b585f1fd340 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -105,6 +105,8 @@ int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *op,
                            unsigned int num);
 int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
                            unsigned int num);
+int lwtunnel_valid_encap_type(u16 encap_type);
+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len);
 int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
                          struct nlattr *encap,
                          unsigned int family, const void *cfg,
@@ -168,6 +170,15 @@ static inline int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
         return -EOPNOTSUPP;
 }
 
+static inline int lwtunnel_valid_encap_type(u16 encap_type)
+{
+        return -EOPNOTSUPP;
+}
+static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
+{
+        return -EOPNOTSUPP;
+}
+
 static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
                                        struct nlattr *encap,
                                        unsigned int family, const void *cfg,
diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
index a5d4e866ce88..47b1dd65947b 100644
--- a/net/core/lwtunnel.c
+++ b/net/core/lwtunnel.c
@@ -26,6 +26,7 @@
 #include <net/lwtunnel.h>
 #include <net/rtnetlink.h>
 #include <net/ip6_fib.h>
+#include <net/nexthop.h>
 
 #ifdef CONFIG_MODULES
 
@@ -114,25 +115,74 @@ int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
         ret = -EOPNOTSUPP;
         rcu_read_lock();
         ops = rcu_dereference(lwtun_encaps[encap_type]);
+        if (likely(ops && ops->build_state))
+                ret = ops->build_state(dev, encap, family, cfg, lws);
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(lwtunnel_build_state);
+
+int lwtunnel_valid_encap_type(u16 encap_type)
+{
+        const struct lwtunnel_encap_ops *ops;
+        int ret = -EINVAL;
+
+        if (encap_type == LWTUNNEL_ENCAP_NONE ||
+            encap_type > LWTUNNEL_ENCAP_MAX)
+                return ret;
+
+        rcu_read_lock();
+        ops = rcu_dereference(lwtun_encaps[encap_type]);
+        rcu_read_unlock();
 #ifdef CONFIG_MODULES
         if (!ops) {
                 const char *encap_type_str = lwtunnel_encap_str(encap_type);
 
                 if (encap_type_str) {
-                        rcu_read_unlock();
+                        __rtnl_unlock();
                         request_module("rtnl-lwt-%s", encap_type_str);
+                        rtnl_lock();
+
                         rcu_read_lock();
                         ops = rcu_dereference(lwtun_encaps[encap_type]);
+                        rcu_read_unlock();
                 }
         }
 #endif
-        if (likely(ops && ops->build_state))
-                ret = ops->build_state(dev, encap, family, cfg, lws);
-        rcu_read_unlock();
+        return ops ? 0 : -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(lwtunnel_valid_encap_type);
 
-        return ret;
+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining)
+{
+        struct rtnexthop *rtnh = (struct rtnexthop *)attr;
+        struct nlattr *nla_entype;
+        struct nlattr *attrs;
+        struct nlattr *nla;
+        u16 encap_type;
+        int attrlen;
+
+        while (rtnh_ok(rtnh, remaining)) {
+                attrlen = rtnh_attrlen(rtnh);
+                if (attrlen > 0) {
+                        attrs = rtnh_attrs(rtnh);
+                        nla = nla_find(attrs, attrlen, RTA_ENCAP);
+                        nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
+
+                        if (nla_entype) {
+                                encap_type = nla_get_u16(nla_entype);
+
+                                if (lwtunnel_valid_encap_type(encap_type) != 0)
+                                        return -EOPNOTSUPP;
+                        }
+                }
+                rtnh = rtnh_next(rtnh, &remaining);
+        }
+
+        return 0;
 }
-EXPORT_SYMBOL(lwtunnel_build_state);
+EXPORT_SYMBOL(lwtunnel_valid_encap_type_attr);
 
 void lwtstate_free(struct lwtunnel_state *lws)
 {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index eae0332b0e8c..7db2ad2e82d3 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -46,6 +46,7 @@
 #include <net/rtnetlink.h>
 #include <net/xfrm.h>
 #include <net/l3mdev.h>
+#include <net/lwtunnel.h>
 #include <trace/events/fib.h>
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
@@ -677,6 +678,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
                         cfg->fc_mx_len = nla_len(attr);
                         break;
                 case RTA_MULTIPATH:
+                        err = lwtunnel_valid_encap_type_attr(nla_data(attr),
+                                                             nla_len(attr));
+                        if (err < 0)
+                                goto errout;
                         cfg->fc_mp = nla_data(attr);
                         cfg->fc_mp_len = nla_len(attr);
                         break;
@@ -691,6 +696,9 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
                         break;
                 case RTA_ENCAP_TYPE:
                         cfg->fc_encap_type = nla_get_u16(attr);
+                        err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
+                        if (err < 0)
+                                goto errout;
                         break;
                 }
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4f6b067c8753..7ea85370c11c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2896,6 +2896,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tb[RTA_MULTIPATH]) {
                 cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
                 cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
+
+                err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
+                                                     cfg->fc_mp_len);
+                if (err < 0)
+                        goto errout;
         }
 
         if (tb[RTA_PREF]) {
@@ -2909,9 +2914,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tb[RTA_ENCAP])
                 cfg->fc_encap = tb[RTA_ENCAP];
 
-        if (tb[RTA_ENCAP_TYPE])
+        if (tb[RTA_ENCAP_TYPE]) {
                 cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);
 
+                err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
+                if (err < 0)
+                        goto errout;
+        }
+
         if (tb[RTA_EXPIRES]) {
                 unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);