Eric DumazetandGreg Kroah-Hartman 13336a6239 net/sched: cls_u32: use skb_header_pointer_careful() ...

[ Upstream commit cabd1a9763 ]

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221

Fixes: fbc2e7d9cf ("cls_u32: use skb_header_pointer() to dereference data safely")
Reported-by: GangMin Kim <km.kim1503@gmail.com>
Closes: https://lore.kernel.org/netdev/CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com/T/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260128141539.3404400-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-02-11 13:39:14 +01:00

..

act_api.c

…

act_bpf.c

bpf: Add bpf_prog_run_data_pointers()

2025-11-24 10:30:04 +01:00

act_connmark.c

net: sched: act_connmark: initialize struct tc_ife to fix kernel leak

2025-11-24 10:30:00 +01:00

act_csum.c

…

act_ct.c

…

act_ctinfo.c

net_sched: act_ctinfo: use atomic64_t for three counters

2025-08-15 12:08:47 +02:00

act_gact.c

…

act_gate.c

…

act_ife.c

net/sched: act_ife: convert comma to semicolon

2026-02-06 16:48:28 +01:00

act_ipt.c

…

act_meta_mark.c

…

act_meta_skbprio.c

…

act_meta_skbtcindex.c

…

act_mirred.c

…

act_mpls.c

…

act_nat.c

…

act_pedit.c

…

act_police.c

…

act_sample.c

…

act_simple.c

…

act_skbedit.c

…

act_skbmod.c

…

act_tunnel_key.c

net: fix geneve_opt length integer overflow

2025-04-10 14:37:40 +02:00

act_vlan.c

…

cls_api.c

tc: Ensure we have enough buffer space when sending filter netlink notifications

2025-04-25 10:45:06 +02:00

cls_basic.c

…

cls_bpf.c

bpf: Add bpf_prog_run_data_pointers()

2025-11-24 10:30:04 +01:00

cls_cgroup.c

…

cls_flow.c

net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

2025-01-17 13:36:12 +01:00

cls_flower.c

net: fix geneve_opt length integer overflow

2025-04-10 14:37:40 +02:00

cls_fw.c

…

cls_matchall.c

…

cls_route.c

…

cls_u32.c

net/sched: cls_u32: use skb_header_pointer_careful()

2026-02-11 13:39:14 +01:00

em_canid.c

…

em_cmp.c

…

em_ipset.c

…

em_ipt.c

…

em_meta.c

…

em_nbyte.c

…

em_text.c

…

em_u32.c

…

ematch.c

…

Kconfig

…

Makefile

…

sch_api.c

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-11-02 22:14:40 +09:00

sch_blackhole.c

…

sch_cake.c

net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

2026-01-11 15:21:35 +01:00

sch_cbs.c

net/sched: cbs: Fix integer overflow in cbs_set_port_rate()

2024-12-14 20:00:03 +01:00

sch_choke.c

net: sched: fix ordering of qlen adjustment

2024-12-27 13:58:41 +01:00

sch_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_drr.c

sch_drr: make drr_qlen_notify() idempotent

2025-05-09 09:44:04 +02:00

sch_etf.c

…

sch_ets.c

net/sched: ets: Remove drr class from the active list if it changes to strict

2026-01-11 15:21:46 +01:00

sch_fifo.c

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

2025-03-13 12:58:40 +01:00

sch_fq_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_fq_pie.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_fq.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_frag.c

…

sch_generic.c

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

2026-02-06 16:48:29 +01:00

sch_gred.c

sched: address a potential NULL pointer dereference in the GRED scheduler.

2025-03-22 12:50:38 -07:00

sch_hfsc.c

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-11-02 22:14:40 +09:00

sch_hhf.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_htb.c

net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate

2025-08-28 16:28:49 +02:00

sch_ingress.c

…

sch_mq.c

…

sch_mqprio_lib.c

…

sch_mqprio_lib.h

…

sch_mqprio.c

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

2025-08-15 12:09:03 +02:00

sch_multiq.c

…

sch_netem.c

net/sched: Restrict conditions for adding duplicating netems to qdisc tree

2025-08-15 12:08:47 +02:00

sch_pie.c

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:12:15 +02:00

sch_plug.c

…

sch_prio.c

net_sched: prio: fix a race in prio_tune()

2025-06-19 15:28:43 +02:00

sch_qfq.c

net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

2026-01-30 10:27:33 +01:00

sch_red.c

net_sched: red: fix a race in __red_change()

2025-06-19 15:28:43 +02:00

sch_sfb.c

…

sch_sfq.c

net_sched: sch_sfq: reject invalid perturb period

2025-06-27 11:08:59 +01:00

sch_skbprio.c

net_sched: skbprio: Remove overly strict queue assertions

2025-04-10 14:37:39 +02:00

sch_taprio.c

net/sched: taprio: enforce minimum value for picos_per_byte

2025-08-15 12:09:03 +02:00

sch_tbf.c

net_sched: tbf: fix a race in tbf_change()

2025-06-19 15:28:43 +02:00

sch_teql.c

net/sched: Enforce that teql can only be used as root qdisc

2026-01-30 10:27:33 +01:00