[PATCH net] phonet: pep: fix use-after-free in pep_get_sb()

[PATCH net] phonet: pep: fix use-after-free in pep_get_sb()

[Breno Leitao]

pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
the skb data, and continue to access the older pointer, causing UAF.

Reproduced under KASAN:

  BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
  Read of size 1 at addr ff11000105510f50 by task repro/157
   pep_get_sb+0x234/0x3b0
   pipe_handler_do_rcv+0x5f7/0xa10
   pep_do_rcv+0x203/0x410
   __sk_receive_skb+0x471/0x4a0
   phonet_rcv+0x5b3/0x6c0
   __netif_receive_skb+0xcc/0x1d0

Refetch the header with skb_header_pointer() after pskb_may_pull(), so
the possibly stale pointer is no longer dereferenced. There are better
ways to solve this, but, this is the less instrusive one.

Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
---
This showed up in sashiko report, when I've sent my other patchset
https://lore.kernel.org/all/20260720-getsockopt_phase4-v2-0-8a08fcfa0d72@debian.org/
---
 net/phonet/pep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7069271393933..31b29e3ca7bc6 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -55,6 +55,8 @@ static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
 	ph = skb_header_pointer(skb, 0, 2, &h);
 	if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
 		return NULL;
+	/* pskb_may_pull() may have reallocated the head; refetch ph. */
+	ph = skb_header_pointer(skb, 0, 2, &h);
 	ph->sb_len -= 2;
 	*ptype = ph->sb_type;
 	*plen = ph->sb_len;

---
base-commit: 1c975de3343cdef506f2eecc833cc1f14b0401c4
change-id: 20260720-phonet_get_sb_uaf-8745e9d9d62c

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH net] phonet: pep: fix use-after-free in pep_get_sb()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 21 Jul 2026 01:58:45 -0700 you wrote:
> pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
> the skb data, and continue to access the older pointer, causing UAF.
> 
> Reproduced under KASAN:
> 
>   BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
>   Read of size 1 at addr ff11000105510f50 by task repro/157
>    pep_get_sb+0x234/0x3b0
>    pipe_handler_do_rcv+0x5f7/0xa10
>    pep_do_rcv+0x203/0x410
>    __sk_receive_skb+0x471/0x4a0
>    phonet_rcv+0x5b3/0x6c0
>    __netif_receive_skb+0xcc/0x1d0
> 
> [...]

Here is the summary with links:
  - [net] phonet: pep: fix use-after-free in pep_get_sb()
    https://git.kernel.org/netdev/net/c/0f71f852a96a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html