skb_try_coalesce() keeps from->len, which is unsigned, in an int. A corrupt from->len above INT_MAX turns negative and gets past the len <= skb_tailroom(to) check. Commit 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails in copy helpers") moved the copy into the tailroom ahead of skb_put(), so that check is now the only thing left in the way: skb_copy_bits() clamps its copy to the negative length, and memcpy() takes it as an unsigned int, so it becomes a ~2GB write past the end of @to. Before that commit skb_put() ran first, and its overflow check caught such a length before anything was copied. Keep len unsigned, like from->len. skb_tailroom() is never negative, so the tailroom check then refuses such a length, and every other use of len already takes an unsigned value. The truesize sanity check compares the int delta against len; spell out its delta < 0 case so a negative delta still warns now that the comparison is unsigned. Found by the Sashiko AI review of v2 of the series that made the change. Fixes: 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails in copy helpers") Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com/ Assisted-by: LLM Signed-off-by: Josef Bacik --- net/core/skbuff.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 735dd25213bb..5c89c463f234 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6392,7 +6392,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, bool *fragstolen, int *delta_truesize) { struct skb_shared_info *to_shinfo, *from_shinfo; - int i, delta, len = from->len; + unsigned int len = from->len; + int i, delta; *fragstolen = false; @@ -6463,7 +6464,7 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, delta = from->truesize - SKB_TRUESIZE(skb_end_offset(from)); } - WARN_ON_ONCE(delta < len); + WARN_ON_ONCE(delta < 0 || delta < len); memcpy(to_shinfo->frags + to_shinfo->nr_frags, from_shinfo->frags, -- 2.55.0