Re: [PATCH v2] xfrm6: fix slab-out-of-bounds write in xfrm6_input_addr()

I Viswanath
2026-04-01T16:26:54Z

On Wed, 1 Apr 2026 at 10:26, <nicholas@carlini.com> wrote:

> - if (1 + sp->len == XFRM_MAX_DEPTH) {
> + if (1 + sp->len >= XFRM_MAX_DEPTH) {
> XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
> goto drop;
> }

If you look at other places where sp->len is incremented, you will
notice the guard condition is always (sp->len == XFRM_MAX_DEPTH). This
bug exists because in xfrm6_input.c, the greatest valid index is taken
to be XFRM_MAX_DEPTH - 2 when it should be XFRM_MAX_DEPTH - 1.
Therefore, The correct fix should be using the common guard not
changing the guard to use >=

On a tangential note, There is no guard present before the increment
in xfrm_output.c which is probably another OOB bug