Eric Dumazet f202578efc flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() ... bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above. Fixes: d58e468b11 ("flow_dissector: implements flow dissector BPF hook") Signed-off-by: Eric Dumazet <edumazet@kernel.org> Link: https://patch.msgid.link/20261007045616.445596-1-edumazet@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-10-07 17:57:04 -07:00
..
bpf_ksock.c	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
bpf_sk_storage.c	bpf: Fix UAF in sock clone early bailouts	2026-07-09 18:44:16 +02:00
datagram.c	net: devmem: prevent net-iov / page mixing	2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c
dev_addr_lists.c	net: turn the rx_mode work into a generic netdev_work facility	2026-06-25 10:18:40 -07:00
dev_api.c
dev_ioctl.c	net: ethtool: let tsconfig reach a PHY-only timestamp provider	2026-09-28 19:26:41 -07:00
dev.c	net: make dev_xdp_sb_prog_count() see programs attached through a link	2026-10-05 15:01:19 -07:00
dev.h	net: flush skb_defer_nodes in dev_cpu_dead()	2026-09-24 10:48:10 -07:00
devmem.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
devmem.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
drop_monitor.c	drop_monitor: fix out-of-bounds write in reset_per_cpu_data()	2026-09-15 17:58:35 -07:00
dst_cache.c
dst.c
failover.c	net: failover: check register_netdevice_notifier() error in failover_init()	2026-08-04 18:46:34 -07:00
fib_notifier.c
fib_rules.c	net: fib_rules: Destroy ops->lock in fib_rules_unregister().	2026-07-07 10:51:06 +02:00
filter.c	bpf: Fix bpf_sock context code generation	2026-09-22 19:34:04 +00:00
flow_dissector.c	flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()	2026-10-07 17:57:04 -07:00
flow_offload.c
gen_estimator.c
gen_stats.c
gro_cells.c	net: iptunnel: fix stale transport header during tunnel decapsulation	2026-08-28 15:53:46 -07:00
gro.c	net: gro: fix double aggregation of flush-marked skbs	2026-07-21 08:30:54 -07:00
gso.c	net: gso: limit recursive IP-in-IP segmentation	2026-09-29 12:02:37 +02:00
hotdata.c
hwbm.c
ieee8021q_helpers.c
link_watch.c	net: rename netdev_ops_assert_locked()	2026-06-04 14:04:55 -07:00
lock_debug.c	net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers	2026-07-07 15:31:37 +02:00
lwt_bpf.c	lwt_bpf: Restore reserved headroom after xmit program	2026-08-17 10:59:03 +02:00
lwtunnel.c	net: lwtunnel: Drop skb metadata before LWT encapsulation	2026-06-23 19:07:23 -07:00
Makefile	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c	neighbour: Skip default parms when resumed in neightbl_dump_info().	2026-09-11 17:25:14 -07:00
net_namespace.c	net: fix a resource leak in copy_net_ns() error handling path	2026-08-25 12:30:55 +02:00
net_test.c
net-procfs.c
net-sysfs.c	net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc	2026-08-17 10:27:48 -07:00
net-sysfs.h	net: Defer netdev KOBJ_ADD uevent until the device is published	2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c
netdev_config.c
netdev_queues.c	net: expect instance lock in netdev_queue_get_dma_dev()	2026-08-10 15:54:42 -07:00
netdev_rx_queue.c	net: Stop leased rxq before uninstalling its memory provider	2026-06-11 15:57:39 -07:00
netdev_work.c	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
netdev-genl-gen.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl-gen.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl.c	net: devmem: document that bind-tx is unprivileged by design	2026-09-22 18:40:15 -07:00
netevent.c
netmem_priv.h
netpoll.c	netconsole: move netpoll_wait_carrier() as netcons_wait_carrier()	2026-07-30 12:14:39 +02:00
netprio_cgroup.c
of_net.c
page_pool_priv.h
page_pool_user.c	net: make page_pool_get_stats() void	2026-05-28 18:10:03 -07:00
page_pool.c	net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()	2026-09-28 18:24:05 -07:00
pktgen.c	net: pktgen: use a consistent flow count	2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c	net: reject oversized tx_queue_len at netlink parse time	2026-09-04 16:30:49 -07:00
scm.c	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
secure_seq.c
selftests.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
skb_fault_injection.c
skbuff.c	net: fix checksum offsets in skb_splice_from_iter()	2026-09-29 17:11:30 -07:00
skmsg.c	bpf, sockmap: Fix self-redirect copied_seq double-counting	2026-09-13 21:50:26 -07:00
sock_diag.c
sock_map.c	bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc	2026-09-22 23:52:20 +00:00
sock_reuseport.c
sock.c	net: restrict SO_RESERVE_MEM to TCP sockets and cap max value	2026-09-28 19:31:54 -07:00
stream.c	net: remove some unused EXPORT_SYMBOL()s	2026-06-12 16:43:11 -07:00
sysctl_net_core.c	net: Const qualify network templated ctl_tables Arrays	2026-08-13 13:12:24 +02:00
timestamping.c
tso.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
utils.c
xdp.c	xdp: fix zero-copy frame layout	2026-08-22 13:10:48 -07:00