Re: [BUG] KASAN: slab-use-after-free Read in u32_classify

[Jamal Hadi Salim]

On Mon, Jan 26, 2026 at 7:26 AM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
> On Mon, Jan 26, 2026 at 1:11 PM 김강민 <km.kim1503@xxxxxxxxx> wrote:
> >
> > I propose the following patch and would appreciate your review.
> >
> > hoff is used as an offset argument to skb_header_pointer() in
> > u32_classify(), and negative values can cause out-of-bounds read. As
> > shown in the code below, offoff follows the same pattern and requires
> > the same validation.
> > ```
> > TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,
> >    const struct tcf_proto *tp,
> >    struct tcf_result *res)
> > {
> > ...
> > if (n) {
> > ...
> > if (n->sel.flags & (TC_U32_OFFSET | TC_U32_VAROFFSET)) {
> > off2 = n->sel.off + 3;
> > if (n->sel.flags & TC_U32_VAROFFSET) {
> > __be16 *data, hdata;
> >
> > data = skb_header_pointer(skb,
> >   off + n->sel.offoff,
> >   2, &hdata);
> > if (!data)
> > goto out;
> > off2 += ntohs(n->sel.offmask & *data) >>
> > n->sel.offshift;
> > }
> > off2 &= ~3;
> > }
> > ...
> > }
> > ...
> > }
> > ```
> > Therefore, I propose a patch that rejects negative hoff and offoff
> > values during u32 classifier configuration.
> >
> > --- a/net/sched/cls_u32.c
> > +++ b/net/sched/cls_u32.c
> > @@ -1104,6 +1104,11 @@ static int u32_change(struct net *net, struct
> > sk_buff *in_skb,
> >   err = -EINVAL;
> >   goto erridr;
> >   }
> > +
> > + if (s->hoff < 0 || s->offoff < 0) {
> > + err = -EINVAL;
> > + goto erridr;
> > + }
> >
>
> Negative values are valid, it is ok to access data between skb->head
> and skb->data.

Right. We have to do this at runtime in classify().
Can you test with your POC with Eric's suggested fix?

Eric, can we do something like pedit? See: offset_valid() usage

Sample config using negative values:
#dst MAC starts at -14
#src MAC at -8
#ethertype at -2
#
#matches: #src MAC address 00:ff:07:e7:29:47 dst MAC 00:ff:07:e7:29:44
tc filter add dev dummy0 parent ffff: protocol ip prio 10 u32 \
match u16 0x00FF 0xffff at -14 \
match u32 0x07E72944 0xffffffff at -12 \
match u32 0x00FF07E7 0xffffffff at -8 \
match u16 0x2947 0xffff at -4 \
flowid 1:12 \
action ok
#

#to display
tc -s filter show parent ffff: dev dummy0


cheers,
jamal