Re: [PATCH net] selftests: net: txtimestamp: fix out-of-bounds read in raw UDP checksum

[Willem de Bruijn]

Jamie Nguyen wrote:
> With -r (SOCK_RAW, IPPROTO_UDP) the test writes only the UDP header and
> payload, and the kernel adds the IP header. get_udp_csum() still expects
> the IP source and destination addresses to directly precede the UDP
> header, and reads 2 * alen bytes before the start of the buffer: 8 bytes
> for IPv4, 32 bytes for IPv6.
> 
> ASan reports a heap-buffer-overflow for both -4 -r and -6 -r. Without
> ASan the read usually goes unnoticed, but it faults when the buffer is
> the first chunk in the heap. That happens on Ubuntu 26.04, where the
> kselftest runner wraps the test in uutils stdbuf, and txtimestamp.sh
> fails with SIGSEGV on every run.
> 
> Even without a crash, -r packets were sent with a checksum computed
> over unrelated heap memory, so their UDP checksum was invalid.
> 
> Build the pseudo-header from the destination address and checksum only
> the UDP header and payload. -R and -P already write daddr as both the
> source and destination address, so their checksums are unchanged. With
> -r the kernel selects the source address, which equals daddr for the
> loopback addresses used by txtimestamp.sh.
> 
> Fixes: b52354aa068e ("selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet")
> Signed-off-by: Jamie Nguyen <jamien@xxxxxxxxxx>

Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>