[PATCH net v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

[PATCH net v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

[Cen Zhang (Microsoft)]

u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
0-255) into the kernel knode object without bounds validation. When a
packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
per C11 6.5.7p3, triggerable by an unprivileged user via user/network
namespaces.

UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int

Fix this by rejecting offshift >= 16 during filter creation in
u32_change().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: AutonomousCodeSecurity@microsoft.com
Link: https://lore.kernel.org/all/20260720034514.23053-1-blbllhy@gmail.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
---
v2:
 - Drop TC_U32_VAROFFSET condition as suggested by Jamal.

 net/sched/cls_u32.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 8f30cc82181d..ac98b1c2144a 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -1107,6 +1107,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
 		goto erridr;
 	}
 
+	if (s->offshift >= 16) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "offshift must be less than 16");
+		err = -EINVAL;
+		goto erridr;
+	}
+
 	n = kzalloc_flex(*n, sel.keys, s->nkeys);
 	if (n == NULL) {
 		err = -ENOBUFS;
-- 
2.53.0

Re: [PATCH net v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 23 Jul 2026 00:49:55 -0400 you wrote:
> u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
> 0-255) into the kernel knode object without bounds validation. When a
> packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
> `ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
> value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
> per C11 6.5.7p3, triggerable by an unprivileged user via user/network
> namespaces.
> 
> [...]

Here is the summary with links:
  - [net,v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
    https://git.kernel.org/netdev/net/c/aef96eead286

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html