Re: [PATCH v2] xfrm6: fix slab-out-of-bounds write in xfrm6_input_addr()

[Steffen Klassert <steffen.klassert@secunet.com>]

On Wed, Apr 01, 2026 at 09:56:40PM +0530, I Viswanath wrote:
> On Wed, 1 Apr 2026 at 10:26, <nicholas@carlini.com> wrote:
> 
> > -       if (1 + sp->len == XFRM_MAX_DEPTH) {
> > +       if (1 + sp->len >= XFRM_MAX_DEPTH) {
> >                 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
> >                 goto drop;
> >         }
> 
> If you look at other places where sp->len is incremented, you will
> notice the guard condition is always (sp->len == XFRM_MAX_DEPTH). This
> bug exists because in xfrm6_input.c, the greatest valid index is taken
> to be XFRM_MAX_DEPTH - 2 when it should be XFRM_MAX_DEPTH - 1.
> Therefore, The correct fix should be using the common guard not
> changing the guard to use >=
> 
> On a tangential note, There is no guard present before the increment
> in xfrm_output.c which is probably another OOB bug

Nicholas, please have a look if you can update your patch based
on these comments.

Thanks!