netdev - Re: [PATCH bpf] bpf: Reject negative head_room in __bpf_skb_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: 
 <176169000576.2404988.18143767699290680049.git-patchwork-notify@kernel.org>
Date: Tue, 28 Oct 2025 22:20:05 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Daniel Borkmann <daniel@...earbox.net>
Cc: martin.lau@...ux.dev, bpf@...r.kernel.org, netdev@...r.kernel.org,
 dddddd@...t.edu.cn, M202472210@...t.edu.cn, dzm91@...t.edu.cn
Subject: Re: [PATCH bpf] bpf: Reject negative head_room in
 __bpf_skb_change_head

Hello:

This patch was applied to bpf/bpf.git (master)
by Martin KaFai Lau <martin.lau@...nel.org>:

On Thu, 23 Oct 2025 14:55:32 +0200 you wrote:
> Yinhao et al. recently reported:
> 
>   Our fuzzing tool was able to create a BPF program which triggered
>   the below BUG condition inside pskb_expand_head.
> 
>   [   23.016047][T10006] kernel BUG at net/core/skbuff.c:2232!
>   [...]
>   [   23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530
>   [...]
>   [   23.021249][T10006] Call Trace:
>   [   23.021387][T10006]  <TASK>
>   [   23.021507][T10006]  ? __pfx_pskb_expand_head+0x10/0x10
>   [   23.021725][T10006]  __bpf_skb_change_head+0x22a/0x520
>   [   23.021939][T10006]  bpf_skb_change_head+0x34/0x1b0
>   [   23.022143][T10006]  ___bpf_prog_run+0xf70/0xb670
>   [   23.022342][T10006]  __bpf_prog_run32+0xed/0x140
>   [...]
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Reject negative head_room in __bpf_skb_change_head
    https://git.kernel.org/bpf/bpf/c/2cbb259ec4f8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html