From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f180.google.com (mail-qt1-f180.google.com [209.85.160.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31A9B3EEAEA for ; Wed, 7 Oct 2026 17:36:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791394591; cv=none; b=VW1fJ2jb7lWD7hgfWXkgbAKbxT91furC5S562Q1JTshKaAMNnfLxgGSjNoQ3S0fLIMLhBhfHgZ+f9OxVtBHfx/tUF+N68UZBZYyjElmgU9e0BZmWnBUGz215qGZp4V3yW5I0TKo7e9JovDPunWR9y23q8OR2KIktYht1ztakbKY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791394591; c=relaxed/simple; bh=UfAWlPGQqg3RDuKRzGCzaCnGMtK7225kxdogm7euAY4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qGzFIkMvaxU6DGQveQlHELrMhERCyZFghQ0fWTH08ZUup9F9sJX1Oz4ui0gSqk0K08PbyzNLuZejnF1PEnda4JttkaXIzTt2GW8a02ft5Mchw8EoVqftv5qNDB7vqlLnBZ1c9DQY1omYOQ1mo2d2TuG5Ag8s8OWB3YEcKXTwmIQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com; spf=pass smtp.mailfrom=toxicpanda.com; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b=Ty1RiHM+; arc=none smtp.client-ip=209.85.160.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b="Ty1RiHM+" Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-53391786e55so28255611cf.2 for ; Wed, 07 Oct 2026 10:36:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1791394586; x=1791999386; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UCkGJ8vEAFX9qhjd5vmdoyoQrJArzIQbzoHlWynEGpM=; b=Ty1RiHM+7f74KFnI318YzqaGSvQqlaXbHDcrNXg+wsEgexR4VB+Y/cbWGMTMtDBsNL kjrJhLl7Gae5/Afdj6kvhrCZNGma1m12M5DzbH0MH9yh3X+OOsMIwe5acH3vdSR0fq5N EkJky3XJswS0e0ojjwtU1ixfyMILfVVUlMRUAmXGFk/+9osyq6YdPrbb9Q6+7r9YI62U oRNwLd5tiOcIaD6G9YSnb/eCIFeQFOksZ1HvK5cK4ToRjbgJPKuVchWTcAk1WJOXXzK4 A1mfbqlTyvUa6ekWaNV+IOzk7v8tnsTMdCuNuDkFffK6hnON9BevXC0PxT6/h1tU1wxs z/Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791394586; x=1791999386; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UCkGJ8vEAFX9qhjd5vmdoyoQrJArzIQbzoHlWynEGpM=; b=ePMb0fa3Rvg131jIl4+JZMsGHQXyCf24Bu+a6CXsBIL1UVFbmu5yut999XHXmJE1k4 E9X0OyGysxg/unDNh3cdDV9A9oogeKPT7kXLfyCm39qGbGjBC51j6Jt1SWGfNjyoq/uL MahkWBS2E821SCH57C3HaKDx8Skm5IdKm6wOuSzyEa+7ZOyQ0qwdHc55gyVT/Yz3bPPU qhFwFIhp6uQLJNnn1/e/nnUPl/w++DN477Ser4LCYZ+Hqy1wSvK5EFFkdIvSCUHmpNMa FOwLdsRF9wcLIEIhII6QJm5jagfAtOCX1L0CmVDxdoSvLOhhuuqe6zb2DGsJg59+US1T Bi1g== X-Forwarded-Encrypted: i=1; AKwUvBzbrdJxPGWV9cpX4cUq83DyzHxIpBURK+HJN6z4Xr5CakzqXsasqfc+tGhqEcmMa+DB9jGaEgIQ9WUq30w=@vger.kernel.org X-Gm-Message-State: AFuF++lOEcQuHk/IyPCyS62wV/Czumc12HELzRa9L7SlaqM1JhVrA7js 36f7kgBMMbuY/lhMy0na/Zk0JwbmhMG5fEHY8t9Dmg4k3JBcgDFNDp8y9iNjYJoY660= X-Gm-Gg: AYBFou0Kn6gZIRsIz2VNvBYq/TVTY0mWeuwS3mhcGPXvQ63K2qIqn3YSPN7OapUvdza 9IOFL0gMubT48XZ2PTaFqivfPw3NmIwQoKSX7mDS1QQhb6bp5d8paMAZpf1HSfe6WsQrsxYtHVM kQ0MFHJunBTX7CHkqcJHNHA756ZK7GTk1nGSDsNVgegW6gzyD3X2nyfuxtZcq8J0vrCmJDCWyYm WrP+ciPwCdsdX9rupbLaBIEuP7MleIUTMTyHpRYdrsihk29dKFVQ3XZP3pXRFM9UtDRwBrnZ23Z rAaxW4eA7wVevomZ+hwPS3k3meMANYv+BeGUDDBVYjqkrWv7FCRmpCrRL4ph9DpeNtdk2ZtpsW8 8z9h68jzwCU23WGmu8yEcld8Xrnnd45n1OKAwKM3LpryW51DtIJXvRuKq/kX83sutDd0/TST+6M 6qczfnNCjNVuxZRRPnihU1L7qfn9mpA6S8mgGfKv3mdzBgYcUcTjYov60c76mr2ZcOKRknjKFYB OIsTGgL7iJBSnY= X-Received: by 2002:a05:622a:4106:b0:531:164:fa73 with SMTP id d75a77b69052e-53575540ec0mr56191091cf.32.1791394585976; Wed, 07 Oct 2026 10:36:25 -0700 (PDT) Received: from toxicpanda.com ([153.61.196.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5357218df11sm24570571cf.23.2026.10.07.10.36.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2026 10:36:25 -0700 (PDT) From: Josef Bacik Date: Wed, 07 Oct 2026 17:36:05 +0000 Subject: [PATCH net-next v2 6/8] net: skbuff: don't BUG() on leftover length in skb_copy_and_csum_bits() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261007-b4-skbuff-bug-on-v2-6-b9a5f732895b@toxicpanda.com> References: <20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com> In-Reply-To: <20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1791394570; l=1690; i=josef@toxicpanda.com; h=from:subject:message-id; bh=UfAWlPGQqg3RDuKRzGCzaCnGMtK7225kxdogm7euAY4=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QHwUBafMKBimgYVVN+bXxgSlOD25sS8QoKd5vmQha27+BivjekrTHnSxba4rwvfVesma/zXcoJX shX51TQQ+jwA= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA skb_copy_and_csum_bits() has the same check as skb_checksum(): it BUG()s if it runs out of skb before it runs out of @len. This one gets hit: commit 7d63b6712538 ("icmp: guard against too small mtu") and commit f99cd56230f5 ("net: Remove acked SYN flag from packet in the transmit queue correctly") each fixed a crash here from icmp_glue_bits(). It can't just return, though. Its callers copy into a buffer that is about to go out on the wire, an ICMP error quoting the offending packet for example, so bailing out early would send whatever was left in the rest of that buffer. Zero the part of the buffer we didn't fill and return 0, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. As with skb_checksum(), the checksum usually won't match the data, so the receiver will usually drop the packet, but either way it carries nothing it shouldn't. @len is an int, so only zero when it is positive; a negative @len from a broken caller must not turn into a huge memset(). Assisted-by: LLM Signed-off-by: Josef Bacik --- net/core/skbuff.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index c896770203f7..7fd2f8142cc4 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3713,7 +3713,13 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, } start = end; } - BUG_ON(len); + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + /* Don't hand the caller a buffer with stale bytes in it. */ + if (len > 0) + memset(to, 0, len); + return 0; + } return csum; } EXPORT_SYMBOL(skb_copy_and_csum_bits); -- 2.55.0