linux-kernel - Re: [BUG] KASAN: slab-use-after-free Read in u32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLhXQ0W7+rOQCqxLpGyoHBAJ_xeUhjL+7MtQmN2saaYog@mail.gmail.com>
Date: Mon, 26 Jan 2026 13:26:11 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: 김강민 <km.kim1503@...il.com>
Cc: davem@...emloft.net, Jamal Hadi Salim <jhs@...atatu.com>, jiri@...nulli.us, 
	kuba@...nel.org, netdev@...r.kernel.org, pabeni@...hat.com, 
	xiyou.wangcong@...il.com, horms@...nel.org, syzkaller@...glegroups.com, 
	linux-kernel@...r.kernel.org
Subject: Re: [BUG] KASAN: slab-use-after-free Read in u32_classify

On Mon, Jan 26, 2026 at 1:11 PM 김강민 <km.kim1503@...il.com> wrote:
>
> I propose the following patch and would appreciate your review.
>
> hoff is used as an offset argument to skb_header_pointer() in
> u32_classify(), and negative values can cause out-of-bounds read. As
> shown in the code below, offoff follows the same pattern and requires
> the same validation.
> ```
> TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,
>    const struct tcf_proto *tp,
>    struct tcf_result *res)
> {
> ...
> if (n) {
> ...
> if (n->sel.flags & (TC_U32_OFFSET | TC_U32_VAROFFSET)) {
> off2 = n->sel.off + 3;
> if (n->sel.flags & TC_U32_VAROFFSET) {
> __be16 *data, hdata;
>
> data = skb_header_pointer(skb,
>   off + n->sel.offoff,
>   2, &hdata);
> if (!data)
> goto out;
> off2 += ntohs(n->sel.offmask & *data) >>
> n->sel.offshift;
> }
> off2 &= ~3;
> }
> ...
> }
> ...
> }
> ```
> Therefore, I propose a patch that rejects negative hoff and offoff
> values during u32 classifier configuration.
>
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -1104,6 +1104,11 @@ static int u32_change(struct net *net, struct
> sk_buff *in_skb,
>   err = -EINVAL;
>   goto erridr;
>   }
> +
> + if (s->hoff < 0 || s->offoff < 0) {
> + err = -EINVAL;
> + goto erridr;
> + }
>

Negative values are valid, it is ok to access data between skb->head
and skb->data.