Syzbot reported a KMSAN uninit-value warning in netif_skb_features() [1], which originates from gso_features_check(): BUG: KMSAN: uninit-value in gso_features_check net/core/dev.c:3804 [inline] BUG: KMSAN: uninit-value in netif_skb_features+0x6fb/0x1870 net/core/dev.c:3828 gso_features_check net/core/dev.c:3804 [inline] netif_skb_features+0x6fb/0x1870 net/core/dev.c:3828 validate_xmit_skb+0xb6/0x2400 net/core/dev.c:4003 ... __dev_queue_xmit+0x3016/0x5a50 net/core/dev.c:4795 packet_snd net/packet/af_packet.c:3077 [inline] packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3109 The current code dereferences iph->frag_off directly to decide whether to clear mangleid_features. For malformed or truncated skb data, this can read invalid/uninitialized header bytes. Use skb_header_pointer() to read the IPv4 header safely from either the outer or inner network header offset. If the header is not accessible, conservatively clear mangleid_features. This keeps the original behavior for valid packets while fixing the unsafe header access pattern. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407 Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") Reported-by: syzbot+1543a7d954d9c6d00407@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e4b5d8.050a0220.256323.0018.GAE@google.com/T/ Tested-by: syzbot+1543a7d954d9c6d00407@syzkaller.appspotmail.com Signed-off-by: Guoyu Su --- v2: - Drop the SKB_GSO_DODGY shortcut. - Use skb_header_pointer() for safe IPv4 header access. - Add missing Fixes tag as requested. v1: https://lore.kernel.org/netdev/20260307162905.3697050-1-yss2813483011xxl@gmail.com/ net/core/dev.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 14a83f2035b9..c70263654680 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3805,10 +3805,13 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, * segmentation-offloads.rst). */ if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) { - struct iphdr *iph = skb->encapsulation ? - inner_ip_hdr(skb) : ip_hdr(skb); + struct iphdr _iph; + const struct iphdr *iph; + int nhoff = skb->encapsulation ? + skb_inner_network_offset(skb) : skb_network_offset(skb); - if (!(iph->frag_off & htons(IP_DF))) + iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); + if (!iph || !(iph->frag_off & htons(IP_DF))) features &= ~dev->mangleid_features; } -- 2.34.1