Re: [PATCH bpf v2 01/11] bpf: Fix bounds check for skb-backed dynptrs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: commit message claims u64 arithmetic but uses 32-bit unsigned
--

commit 5861693b35f3cce5042bdc052c43183ecc29425f
Author: Emil Tsalapatis <emil@etsalapatis.com>

bpf: Fix bounds check for skb-backed dynptrs

This commit fixes an underflow vulnerability in the bounds check for
skb-backed dynptrs within skb_pointer_if_linear(). It prevents spurious
passes by converting offsets and lengths to unsigned integers before
performing bounds comparisons.

> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index 421f6fc454511..c8e21903074c3 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -4372,7 +4372,10 @@ skb_header_pointer_careful(const struct sk_buff *skb, int offset,
>  static inline void * __must_check
>  skb_pointer_if_linear(const struct sk_buff *skb, int offset, int len)
>  {
> -	if (likely(skb_headlen(skb) - offset >= len))
> +	unsigned int uoffset = (unsigned int)offset;
> +
> +	if (likely(uoffset <= skb_headlen(skb) &&
> +		   (unsigned int)len <= skb_headlen(skb) - uoffset))

[Severity: Medium]
The commit message explicitly states "Use u64 arithmetic to also prevent
overflow when calculating (skb_headlen(skb) - off)", but this implementation
strictly uses 32-bit unsigned arithmetic.

Since the 32-bit unsigned math appears to correctly prevent the underflow and
overflow in this context, is the commit message's reference to u64 arithmetic
inaccurate? Does the commit message need to be updated to match the
unsigned int implementation here?

>  		return skb->data + offset;
>  	return NULL;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922172028.6269-1-emil@etsalapatis.com?part=1