[PATCH net] net: pktgen: reject out-of-range node indices

[Daehyeon Ko <4ncienth@gmail.com>]

The pktgen node command parses up to ten decimal digits into unsigned
long, then passes the value to node_possible(). That helper takes an int
and tests the node bitmap without a bounds check. A value beyond the
bitmap can read the next node-state mask and be accepted; larger values
can narrow to a negative index. On 32-bit, parsing can also wrap.

On v7.2, an initial-namespace UID 65534 task with no effective
capabilities reached pktgen_if_write() through user and network
namespaces. KASAN reported an eight-byte wild read. The read can cause
a crash; the proc result exposes a limited one-bit outcome. No broader
memory disclosure or privilege escalation has been demonstrated.

Parse this command into u64 and reject node >= MAX_NUMNODES before
converting to int. Preserve the existing OK/ERROR proc results. The
fixed v7.2 KASAN VM passed nine input controls without a KASAN report;
the W=1 pktgen object build was warning-free.

Introduced in v2.6.35, the unchecked call remains in v7.2.7 and
v6.12.111 as checked on 2026-09-24. The read needs
CONFIG_NET_PKTGEN and CONFIG_NUMA (MAX_NUMNODES > 1). The unprivileged
path also needs usable CONFIG_USER_NS and CONFIG_NET_NS. Tested
reproducer source is available privately to maintainers on request.

Fixes: e99b99b471c2 ("pktgen node allocation")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---

KASAN excerpt from the unmodified v7.2 VM:
[    1.739189] BUG: KASAN: wild-memory-access in pktgen_if_write+0x66f5/0x6990
[    1.739389] Read of size 8 at addr 1fffffff891bf658 by task pktgen_userns_p/144

 net/core/pktgen.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 7f81aed46672..9e172a101a1f 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -818,6 +818,25 @@ static ssize_t num_arg(const char __user *user_buffer, size_t maxlen,
 	return i;
 }
 
+/* The node command's ten-digit argument also fits in u64 on 32-bit. */
+static ssize_t num_arg_u64(const char __user *user_buffer, size_t maxlen,
+			   u64 *num)
+{
+	size_t i;
+
+	*num = 0;
+	for (i = 0; i < maxlen; i++) {
+		char c;
+
+		if (get_user(c, &user_buffer[i]))
+			return -EFAULT;
+		if (c < '0' || c > '9')
+			break;
+		*num = *num * 10 + c - '0';
+	}
+	return i;
+}
+
 static ssize_t strn_len(const char __user *user_buffer, size_t maxlen)
 {
 	size_t i;
@@ -1304,13 +1323,15 @@ static ssize_t pktgen_if_write(struct file *file,
 		return count;
 	}
 	if (!strcmp(name, "node")) {
+		u64 node;
+
 		max = min(10, count - i);
-		len = num_arg(&user_buffer[i], max, &value);
+		len = num_arg_u64(&user_buffer[i], max, &node);
 		if (len < 0)
 			return len;
 
-		if (node_possible(value)) {
-			pkt_dev->node = value;
+		if (node < MAX_NUMNODES && node_possible((int)node)) {
+			pkt_dev->node = (int)node;
 			sprintf(pg_result, "OK: node=%d", pkt_dev->node);
 			if (pkt_dev->page) {
 				put_page(pkt_dev->page);

base-commit: 90c2e97ff8245092039ab7ab7492b34427412c9b
-- 
2.55.0