[PATCH net] net: pktgen: reject out-of-range node indices

[PATCH net] net: pktgen: reject out-of-range node indices

[Daehyeon Ko]

The pktgen node command parses up to ten decimal digits into unsigned
long, then passes the value to node_possible(). That helper takes an int
and tests the node bitmap without a bounds check. A value beyond the
bitmap can read the next node-state mask and be accepted; larger values
can narrow to a negative index. On 32-bit, parsing can also wrap.

On v7.2, an initial-namespace UID 65534 task with no effective
capabilities reached pktgen_if_write() through user and network
namespaces. KASAN reported an eight-byte wild read. The read can cause
a crash; the proc result exposes a limited one-bit outcome. No broader
memory disclosure or privilege escalation has been demonstrated.

Parse this command into u64 and reject node >= MAX_NUMNODES before
converting to int. Preserve the existing OK/ERROR proc results. The
fixed v7.2 KASAN VM passed nine input controls without a KASAN report;
the W=1 pktgen object build was warning-free.

Introduced in v2.6.35, the unchecked call remains in v7.2.7 and
v6.12.111 as checked on 2026-09-24. The read needs
CONFIG_NET_PKTGEN and CONFIG_NUMA (MAX_NUMNODES > 1). The unprivileged
path also needs usable CONFIG_USER_NS and CONFIG_NET_NS. Tested
reproducer source is available privately to maintainers on request.

Fixes: e99b99b471c2 ("pktgen node allocation")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---

KASAN excerpt from the unmodified v7.2 VM:
[    1.739189] BUG: KASAN: wild-memory-access in pktgen_if_write+0x66f5/0x6990
[    1.739389] Read of size 8 at addr 1fffffff891bf658 by task pktgen_userns_p/144

 net/core/pktgen.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 7f81aed46672..9e172a101a1f 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -818,6 +818,25 @@ static ssize_t num_arg(const char __user *user_buffer, size_t maxlen,
 	return i;
 }
 
+/* The node command's ten-digit argument also fits in u64 on 32-bit. */
+static ssize_t num_arg_u64(const char __user *user_buffer, size_t maxlen,
+			   u64 *num)
+{
+	size_t i;
+
+	*num = 0;
+	for (i = 0; i < maxlen; i++) {
+		char c;
+
+		if (get_user(c, &user_buffer[i]))
+			return -EFAULT;
+		if (c < '0' || c > '9')
+			break;
+		*num = *num * 10 + c - '0';
+	}
+	return i;
+}
+
 static ssize_t strn_len(const char __user *user_buffer, size_t maxlen)
 {
 	size_t i;
@@ -1304,13 +1323,15 @@ static ssize_t pktgen_if_write(struct file *file,
 		return count;
 	}
 	if (!strcmp(name, "node")) {
+		u64 node;
+
 		max = min(10, count - i);
-		len = num_arg(&user_buffer[i], max, &value);
+		len = num_arg_u64(&user_buffer[i], max, &node);
 		if (len < 0)
 			return len;
 
-		if (node_possible(value)) {
-			pkt_dev->node = value;
+		if (node < MAX_NUMNODES && node_possible((int)node)) {
+			pkt_dev->node = (int)node;
 			sprintf(pg_result, "OK: node=%d", pkt_dev->node);
 			if (pkt_dev->page) {
 				put_page(pkt_dev->page);

base-commit: 90c2e97ff8245092039ab7ab7492b34427412c9b
-- 
2.55.0

Re: [PATCH net] net: pktgen: reject out-of-range node indices

[Simon Horman]

On Thu, Sep 24, 2026 at 02:37:52PM +0900, Daehyeon Ko wrote:
> The pktgen node command parses up to ten decimal digits into unsigned
> long, then passes the value to node_possible(). That helper takes an int
> and tests the node bitmap without a bounds check. A value beyond the
> bitmap can read the next node-state mask and be accepted; larger values
> can narrow to a negative index. On 32-bit, parsing can also wrap.
> 
> On v7.2, an initial-namespace UID 65534 task with no effective
> capabilities reached pktgen_if_write() through user and network
> namespaces. KASAN reported an eight-byte wild read. The read can cause
> a crash; the proc result exposes a limited one-bit outcome. No broader
> memory disclosure or privilege escalation has been demonstrated.
> 
> Parse this command into u64 and reject node >= MAX_NUMNODES before
> converting to int. Preserve the existing OK/ERROR proc results. The
> fixed v7.2 KASAN VM passed nine input controls without a KASAN report;
> the W=1 pktgen object build was warning-free.
> 
> Introduced in v2.6.35, the unchecked call remains in v7.2.7 and
> v6.12.111 as checked on 2026-09-24. The read needs
> CONFIG_NET_PKTGEN and CONFIG_NUMA (MAX_NUMNODES > 1). The unprivileged
> path also needs usable CONFIG_USER_NS and CONFIG_NET_NS. Tested
> reproducer source is available privately to maintainers on request.
> 
> Fixes: e99b99b471c2 ("pktgen node allocation")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>

Thanks for your patch,

I have a few questions.

1.   Does this problem also exist for other callers of num_arg() ?

2.a. Could this be addressed by using kstrtoint() ?
     That seems like it would cover all values that currently work,
     and thus wouldn't change any working use-case.

2.b. Or, if not, some other standard helper?

2.c. Or, it not, could it be addressed by reducing the maximum digits?
     I am skeptical that 10^10 - 1 is a sensible value and thus
     reducing the range seems unlikely to break any legitimate use case.

...

Re: [PATCH net] net: pktgen: reject out-of-range node indices

[Daehyeon Ko]

Hi Simon,

Thanks for reviewing.

1. I checked all 32 num_arg() call sites. Its unchecked accumulation
   also wraps on 32-bit for ten-digit values, including count and delay,
   and several destinations narrow to int or u16. I did not find another
   direct unbounded bitmap lookup among these callers. This is not a
   claim that the other conversions are safe; I have not demonstrated
   another OOB there.

2. kstrtoint() can handle all valid node IDs, with an explicit
   0 <= node < MAX_NUMNODES check before node_possible().
   A direct kstrtoint_from_user() replacement is stricter than num_arg():
   for example, it rejects trailing spaces, whereas num_arg() accepts a
   decimal prefix. kstrtouint() would also need the bitmap range check.

   I propose keeping the existing ten-digit decimal lexer and using
   kstrtoint(..., 10, ...) for conversion, retaining the existing ERROR
   result and write count. This removes the duplicate accumulator and
   prevents 32-bit wrap. A host comparison against the pinned parsers
   passed; this alternative has not yet been built or run as a kernel
   patch.

3. Reducing maxlen alone does not enforce the bitmap bound. It also
   truncates rather than rejects excess digits, so reducing it to nine
   changes valid zero-padded node arguments.

Regards,
Daehyeon

Re: [PATCH net] net: pktgen: reject out-of-range node indices

[Jakub Kicinski]

On Mon, 28 Sep 2026 20:21:04 +0900 Daehyeon Ko wrote:
>    I propose keeping the existing ten-digit decimal lexer and using
>    kstrtoint(..., 10, ...) for conversion, retaining the existing ERROR
>    result and write count. This removes the duplicate accumulator and
>    prevents 32-bit wrap. A host comparison against the pinned parsers
>    passed; this alternative has not yet been built or run as a kernel
>    patch.

👍️