update_ipv6_checksum() computes int transport_len = skb->len - skb_transport_offset(skb); and gates the L4 access on if (likely(transport_len >= sizeof(struct tcphdr))) sizeof yields size_t, so transport_len is converted to unsigned and every negative value passes the guard. inet_proto_csum_replace16() then reads the transport checksum field out of bounds, and writes the updated value back to the same address: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff888131a4cb06 by task ovs_ipv6_oob/696 CPU: 3 UID: 1000 PID: 696 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc2+ #338 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff888131a4c980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff888131a4c980, ffff888131a4cc40) ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares, and ipv6_optlen() returns up to 2048. The last skip is never checked against skb->len, and parse_ipv6hdr() installs the result as the transport header. Reject a negative length. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Norbert Szetei --- Reproducer available on request. net/openvswitch/actions.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index dc5ff859f114..4fdc08cca058 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -360,6 +360,9 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto, { int transport_len = skb->len - skb_transport_offset(skb); + if (unlikely(transport_len < 0)) + return; + if (l4_proto == NEXTHDR_TCP) { if (likely(transport_len >= sizeof(struct tcphdr))) inet_proto_csum_replace16(&tcp_hdr(skb)->check, skb, -- 2.55.0