[PATCH v4] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d

[PATCH v4] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d

[Ranganath V N]

Fix an issue detected by  syzbot with KMSAN
BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0
net/wireless/util.c:1027

The function accessed DSCP fields from IP and IPv6 headers without first
verifying that sufficient header data was present in the skb. When a
packet reaches this path, the header dereference could access
uninitialized memory, as reported by KMSAN under fuzzing with syzkaller.

Add explicit skb_header_pointer() checks for both IPv4 and IPv6 headers to
ensure that the required header data is available before extracting the
DSCP field. This prevents uninitialized memory reads while preserving
existing behavior for valid packets

This fix has been tested and validated by syzbot. This patch closes the
bug reported at the following syzkaller link.Fixes the uninitialized
header access.

Reported-by: syzbot+878ddc3962f792e9af59@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com./bug?extid=878ddc3962f792e9af59
Tested-by: syzbot+878ddc3962f792e9af59@syzkaller.appspotmail.com
Fixes: b156579b1404 ("wireless: Treat IPv6 diffserv the same as IPv4 for 802.11e")
Signed-off-by: Ranganath V N <vnranganath.20@gmail.com>
---
validate header before DSCP read in cfg80211_classify8021d().
skb_header_pointer() checks before accessing header structures to ensure
safe and fully initialized data access.

Changes in v4:
- Corrected the code by using the pulled data to read the dscp.
- Link to v3: https://lore.kernel.org/all/20251118150524.7973-1-vnranganath.20@gmail.com/

Changes in v3:
- Corrected the code by using the correct offset  past the header.
  similar to the existing MPLs handling logic.
- Link to v2:https://lore.kernel.org/all/20251108-fifth-v2-1-405da01c6684@gmail.com

Changes in v2:
- Corrected the commit subject and Fixes tag.
- Link to v1: https://lore.kernel.org/r/20251103-fifth-v1-1-4a221737ddfe@gmail.com
---
 net/wireless/util.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 56724b33af04..c403e2be18e9 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -962,12 +962,28 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 	}
 
 	switch (skb->protocol) {
-	case htons(ETH_P_IP):
-		dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
+	case htons(ETH_P_IP): {
+		struct iphdr iph, *ip;
+
+		ip = skb_header_pointer(skb, sizeof(struct ethhdr),
+					sizeof(*ip), &iph);
+		if (!ip)
+			return 0;
+
+		dscp = ipv4_get_dsfield(ip) & 0xfc;
 		break;
-	case htons(ETH_P_IPV6):
-		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
+	}
+	case htons(ETH_P_IPV6): {
+		struct ipv6hdr ip6h, *ip6;
+
+		ip6 = skb_header_pointer(skb, sizeof(struct ethhdr),
+					 sizeof(*ip6), &ip6h);
+		if (!ip6)
+			return 0;
+
+		dscp = ipv6_get_dsfield(ip6) & 0xfc;
 		break;
+	}
 	case htons(ETH_P_MPLS_UC):
 	case htons(ETH_P_MPLS_MC): {
 		struct mpls_label mpls_tmp, *mpls;
-- 
2.43.0

Re: [PATCH v4] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d

[Johannes Berg]

On Wed, 2025-12-03 at 23:24 +0530, Ranganath V N wrote:
> 
> +++ b/net/wireless/util.c
> @@ -962,12 +962,28 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
>  	}
>  
>  	switch (skb->protocol) {
> -	case htons(ETH_P_IP):
> -		dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
> +	case htons(ETH_P_IP): {
> +		struct iphdr iph, *ip;
> +
> +		ip = skb_header_pointer(skb, sizeof(struct ethhdr),
> +					sizeof(*ip), &iph);

The sizeof(struct ethhdr) is probably a *correct* assumption, but
wouldn't skb->network_header make more sense?

Please try to understand the code in question before reposting this
patch *again*, I'm not interested in coding by remote-control.

johannes