From nobody Mon Sep 28 10:43:33 2026 Received: from mail-pj2-f2.google.com (mail-pj2-f2.google.com [74.125.227.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CDB98381EB3 for ; Sun, 23 Aug 2026 14:26:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.130 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787495191; cv=none; b=VIGzSrpzxv4s/fwpulAy8jUQOY7mvcXqLcLnrIlQT6O9ggc2UPXtUojKGd9ze1tXGxVZs4TRKZil8n+0pTv+8rOhOZ63YMh1rDh0yaT667HkrNr7we7+gCrIA+Q54stFLNqswZD6fdMDH2tnrxYqCJI7SLcXOfF6H6c760YTSe4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787495191; c=relaxed/simple; bh=HROw/c6Y0BlXY0my7bZMyZmW2RvDTA+v5z0vY+JjSzk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ic/ewha6ayrnga4S/haCi2oerR+39yVXzof+enPRNPOOSar1PqAt4TDOg6Y+1XUxX3sfc+irc3u5P0wgI7MwzAy/kStn3MWdkGXEFonn/gc4yRaOUgVlI+L+eDQM9tQSk596iwFyMxfa2+RRZKU3/jtA2L/Ucs5u0AuY7//Euqk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=X7bXSfaC; arc=none smtp.client-ip=74.125.227.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="X7bXSfaC" Received: by mail-pj2-f2.google.com with SMTP id d9443c01a7336-2ccc2e84048so9740275ad.1 for ; Sun, 23 Aug 2026 07:26:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787495190; x=1788099990; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Nc2OpDByISqZ6cUjaeCWgnfFVc3xyfspITbujS5lcD8=; b=X7bXSfaCIdw+lkGtwjsHX0Gr6uSP68xugtONC9k9KTo7L0Nt/Kfkg1Klr76ajfq+br b9Zt+RcrKKen5ZC6i9RMHYaAguBd3ZqKPkOpNMZfTCWd1C6ObJa3OiCUw2z1Vg8D/FtP rkiPb2uLtXQaafO30s7yTH7Vu+meQHMOUfruXkvc8j6UTjNd8KEe9gk2Qz1aK2vSZCkU UQD7TRVoucjccpl4Qz4vk0MF7NJHNoe1vnVw0eKGNcn5I3SeeF1SeajfpCeGyy8wj8Ns Xq49hyCDEi/ftcIJojfuhDncNExfIQd0eVlwUkipzAF52ToQYB1mDK79qSfdB9+uRdbP KYgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787495190; x=1788099990; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Nc2OpDByISqZ6cUjaeCWgnfFVc3xyfspITbujS5lcD8=; b=BmhHseuvbVWaczSflQpX74ShXLZBqGlcPSA4g+qFibfw5flPOsndtWfTCjxAXF2r9f aZ9FhKhAj67ltiC8mAV3EJXdpDDn9uJ2VaeQr8zkuicFBYCEmwfIP3iIiGdRhU7urxEn 2q7VwYb0Ala+ePc7vB/3wN+egX5FfqnYRFkNN6T17T/+Mk0HgbVlzzjrzzWk5li+nN22 mpfBvqWW4ocLHvPnOhrnNRqhl7jnG+nBExIfkTmWg9wEWr5LCVG6IwpZiOkcWEnRt4lR fn0wAL9o60MQVJ/xjvGSjwIsHgmHev66LvHM1EGav2pg6ACfaJA4Tj2Tmg9NHKES9c0k iTNQ== X-Forwarded-Encrypted: i=1; AHgh+Rrr/3ReEIdI/tfcT8FxKNIQmxUqPFwKsJh1ZCOs1nDHP/4K2ZODkuUbZB8rZnykp4KJgA+YwxxnS23FVzY=@vger.kernel.org X-Gm-Message-State: AFuF++k/PY4r9uzN7WR4qPsyFPeBREvJ14Ovf8beIanouo73gF8le4Zt w65h31uN0npNfaRRg9Rhd1d8gTOUhZDwJTqBBK/QNlgL+TZcqTQ+j1W1 X-Gm-Gg: AR+sD13ewYWHnuLrVruGAjcz495NLTqXIMZhlyp0GZ/CVkW5G/osrAPAC8o+Zuwr9wB XAD4jys5FDlVHuXW6lniIdbR2Ma58MFZTUu/q6rcLeu03YlfEcnRLbB5aODyQnxMyhCgqqqA/ub ccfWYcUcbG4neuwOU/TFOw1a90/BsPThoPQta5O4p+ne90JztWmI0YRAHPH9VEcXXOtcq3ofumd dy0GWzbGgtBpW/iAkwyv9Q4H7nSEw+Tc5vfjADX8BrjTqluMlxsaUNhaEspYA54xtyzG854Z7jg oc/QH29bNXIojrS3odzZQHaUTvv+BV/91237knUqeFFhg9bUWBnYUGbLxG9YoCfd8wLZFvBrx0A GwnP7/2W8CclVpoxYUh5Mq3TuPXVo/rdsebLis/6vNRFbehDjogWZmPzR/kjrtETTQXtskSg0/O 73ajJNBnEK+gMq5CfMhvWB3xwrnS134oMxQOjim5qqGtdTMULGkTc7PWoj4+TOMNtJlzvf89mPP vCRfF4vug== X-Received: by 2002:a17:903:1a28:b0:2d0:401c:2ebb with SMTP id d9443c01a7336-2d64adc3f0amr374069365ad.4.1787495189979; Sun, 23 Aug 2026 07:26:29 -0700 (PDT) Received: from J4f-Laptop.localdomain ([2409:8a55:94ef:8231:5513:5a56:ca01:ec16]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d676895799sm9847435ad.38.2026.08.23.07.26.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 23 Aug 2026 07:26:29 -0700 (PDT) From: Shihuang Liu To: netdev@vger.kernel.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, linux-kernel@vger.kernel.org, Shihuang Liu , stable@vger.kernel.org Subject: [PATCH net] net: skbuff: reject invalid pull bounds Date: Sun, 23 Aug 2026 22:26:20 +0800 Message-ID: <20260823142620.126424-1-shlomojune6@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" skb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max argument and passes the result to __pskb_pull_tail() as a signed int. The function does not ensure that max is at least skb_headlen(skb). This can happen while parsing IPv6 extension headers when an skb already has a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data beyond the linear area, max - skb_headlen(skb) wraps and is converted to a negative delta. __pskb_pull_tail() then passes that negative length to skb_copy_bits(), where it can become a very large copy length. Reject this inconsistent bound before doing the subtraction. In this case pulling up to max cannot satisfy len because the initial check established that skb_headlen(skb) is smaller than len. Fixes: 1431fb31ecba ("xen-netback: fix fragment detection in checksum setup= ") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Shihuang Liu --- net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index c82a147..33022f7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5838,6 +5838,9 @@ static int skb_maybe_pull_tail(struct sk_buff *skb, u= nsigned int len, if (max > skb->len) max =3D skb->len; =20 + if (max < skb_headlen(skb)) + return -EPROTO; + if (__pskb_pull_tail(skb, max - skb_headlen(skb)) =3D=3D NULL) return -ENOMEM; =20 --=20 2.43.0