Re: [PATCH net-next v1 05/15] net: add METADATA_PSP dst to carry a psp association on an skb

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] net: out-of-bounds read in skb_metadata_dst_cmp() [1]
--

commit bf04d738461897fa25a1f7c67c60f36977a2704d
Author: Todd Freed <toddfreed@meta.com>

net: add METADATA_PSP dst to carry a psp association on an skb

This commit adds a METADATA_PSP metadata_dst type to hold a reference to a
PSP association on socket-less skbs and validates target device and MTU
constraints during transmission.

> diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
> index f45d1e3163f00..73755bce2df06 100644
> --- a/include/net/dst_metadata.h
> +++ b/include/net/dst_metadata.h
[ ... ]
> @@ -125,6 +142,8 @@ static inline int skb_metadata_dst_cmp(const struct sk_buff *skb_a,
>  	case METADATA_XFRM:
>  		return memcmp(&a->u.xfrm_info, &b->u.xfrm_info,
>  			      sizeof(a->u.xfrm_info));
> +	case METADATA_PSP:
> +		return a->u.psp_info.pas != b->u.psp_info.pas;
>  	default:
>  		return 1;
>  	}

[Severity: Critical]
This problem wasn't introduced by this patch, but can skb_metadata_dst_cmp()
trigger an out-of-bounds read [1] by casting skb_dst() without checking
DST_METADATA?

include/net/dst_metadata.h:skb_metadata_dst_cmp() {
	...
	a = (const struct metadata_dst *) skb_dst(skb_a);
	b = (const struct metadata_dst *) skb_dst(skb_b);

	if (!a != !b || a->type != b->type)
		return 1;
	...
}

When loopback_xmit() preserves a standard rtable via skb_dst_force() and the
packet enters gro_list_prepare(), skb_metadata_dst_cmp() downcasts the rtable
to struct metadata_dst without using skb_metadata_dst(). Because struct
metadata_dst is larger than struct rtable, reading a->type and the union
members (such as METADATA_IP_TUNNEL's tun_info and options_len) reads past
the rtable slab object, which can crash the kernel if the access crosses an
unmapped page boundary.

[1] https://sashiko.dev/#/bug/linux-cad8ab9c-3c7e-48ba-8546-0bb9ceb5d8be

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111005533.6436-1-toddfreed@meta.com?part=5