The skb_checksum_help() function does not validate negative offset values returned by skb_checksum_start_offset(). This can occur when __skb_pull() is called on a packet, increasing the headroom while leaving csum_start unchanged. A negative offset causes out-of-bounds memory access: - skb_checksum() reads before skb->data when computing the checksum - skb_checksum_help() writes before skb->data Add validation to detect and reject negative offsets. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 663ead3bb8d5 ("[NET]: Use csum_start offset instead of skb_transport_header") Signed-off-by: Junrui Luo --- net/core/dev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/core/dev.c b/net/core/dev.c index 9094c0fb8c68..30161b9240a2 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3574,6 +3574,11 @@ int skb_checksum_help(struct sk_buff *skb) offset = skb_checksum_start_offset(skb); ret = -EINVAL; + if (unlikely(offset < 0)) { + DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); + WARN_ONCE(true, "offset (%d) < 0\n", offset); + goto out; + } if (unlikely(offset >= skb_headlen(skb))) { DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); WARN_ONCE(true, "offset (%d) >= skb_headlen() (%u)\n", --- base-commit: cfd4039213e7b5a828c5b78e1b5235cac91af53d change-id: 20251210-fixes-ef9fa1c91916 Best regards, -- Junrui Luo