Re: [PATCH RESEND net v2 1/1] net/sched: sch_netem: fix out-of-bounds access in packet corruption

patchwork-bot+netdevbpf
2026-04-02T03:00:26Z

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 31 Mar 2026 16:00:21 +0800 you wrote:
> In netem_enqueue(), the packet corruption logic uses
> get_random_u32_below(skb_headlen(skb)) to select an index for
> modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear
> packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.
>
> Passing 0 to get_random_u32_below() takes the variable-ceil slow path
> which returns an unconstrained 32-bit random integer. Using this
> unconstrained value as an offset into skb->data results in an
> out-of-bounds memory access.
>
> [...]

Here is the summary with links:
- [RESEND,net,v2,1/1] net/sched: sch_netem: fix out-of-bounds access in packet corruption
https://git.kernel.org/netdev/net/c/d64cb81dcbd5

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.