Skip to contentSkip to conversation

net/sched: sch_netem: fix out-of-bounds access in packet corruption

PATCH RESEND Applied Yucheng Lu 3 participants 3 messages Mar 31 – Apr 2 1 message not in the archive

Subsystems (4)
Networking Network drivers Traffic control (tc) Netem network emulator
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Yucheng Lu

author
#1 lore raw

PATCH RESEND v2 1/1 net/sched: sch_netem: fix out-of-bounds access in packet corruption

In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.

Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access.

Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.

Fixes c865e5d99e25 ("[PKT_SCHED] netem: packet corruption option")
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Signed-off-by Yuan Tan <[email protected]>
Signed-off-by Xin Liu <[email protected]>
Signed-off-by Yuhang Zheng <[email protected]>
Signed-off-by Yucheng Lu <[email protected]>

---

This email was not CCed to the public mailing list previously, so I am resending it with the mailing list included. Sorry for the inconvenience.

 net/sched/sch_netem.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
net/sched/sch_netem.c +3 -2
index 5de1c932944a..da9e2f60160c 100644
@@ -519,8 +519,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 			goto finish_segs;
 		}
 
-		skb->data[get_random_u32_below(skb_headlen(skb))] ^=
-			1<<get_random_u32_below(8);
+		if (skb_headlen(skb))
+			skb->data[get_random_u32_below(skb_headlen(skb))] ^=
+				1 << get_random_u32_below(8);
 	}
 
 	if (unlikely(q->t_len >= sch->limit)) {
Signature · 1 line
2.47.3
maintainer Reviewed-by on v2 1/1
#2 lore raw
Quoted 14 lines · On Tue, 31 Mar 2026 16:00:21 +0800 Yucheng Lu <[email protected]> wrote:

In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.

Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access.

Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.

Quoted 8 lines
Fixes c865e5d99e25 ("[PKT_SCHED] netem: packet corruption option")
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Signed-off-by Yuan Tan <[email protected]>
Signed-off-by Xin Liu <[email protected]>
Signed-off-by Yuhang Zheng <[email protected]>
Signed-off-by Yucheng Lu <[email protected]>

---

This is the correct fix for the net tree. Will make a more robust fix for net-next which handles non linear packets better.

Reviewed-by Stephen Hemminger <[email protected]>
CI Applied
#3 lore raw
In reply to Yucheng Lu
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 11 lines · On Tue, 31 Mar 2026 16:00:21 +0800 you wrote:

In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.

Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access.

[...]

Here is the summary with links:
- [RESEND,net,v2,1/1] net/sched: sch_netem: fix out-of-bounds access in packet corruption

    https://git.kernel.org/netdev/net/c/d64cb81dcbd5

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html