netdev - Re: [BUG] KASAN: slab-use-after-free Read in u32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com>
Date: Tue, 27 Jan 2026 14:31:08 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: GangMin Kim <km.kim1503@...il.com>
Cc: Jamal Hadi Salim <jhs@...atatu.com>, davem@...emloft.net, jiri@...nulli.us, 
	kuba@...nel.org, netdev@...r.kernel.org, pabeni@...hat.com, 
	xiyou.wangcong@...il.com, horms@...nel.org, syzkaller@...glegroups.com, 
	linux-kernel@...r.kernel.org
Subject: Re: [BUG] KASAN: slab-use-after-free Read in u32_classify

On Tue, Jan 27, 2026 at 12:48 AM GangMin Kim <km.kim1503@...il.com> wrote:
>
> Structured the patch following similar commits to prevent out-of-bounds access.
>
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -111,6 +111,17 @@ static inline unsigned int u32_hash_fold(__be32 key,
>   return h;
>  }
>
> +static bool offset_valid(struct sk_buff *skb, int offset)
> +{
> + if (offset > 0 && offset > skb->len)
> + return false;
> +
> + if (offset < 0 && -offset > skb_headroom(skb))
> + return false;
> +
> + return true;
> +}
> +

We need a formal patch :)

I will prepare a series on top of a generic helper, I am sure we
should use it elsewhere

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 86737076101d4a8452e90fe78adcdcfdefb79169..72679aa7af587cad524feba82432154cfb8afbd3
100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -4301,6 +4301,18 @@ skb_header_pointer(const struct sk_buff *skb,
int offset, int len, void *buffer)
                                    skb_headlen(skb), buffer);
 }

+/* Variant of skb_header_pointer() where @offset is user-controlled
+ * and potentially negative.
+ */
+static inline void * __must_check
+skb_header_pointer_careful(const struct sk_buff *skb, int offset,
+                          int len, void *buffer)
+{
+       if (unlikely(offset < 0 && -offset > skb_headlen(skb)))
+               return NULL;
+       return skb_header_pointer(skb, offset, len, buffer);
+}
+
 static inline void * __must_check
 skb_pointer_if_linear(const struct sk_buff *skb, int offset, int len)
 {