skbmark_decode(), skbprio_decode() and skbtcindex_decode() read fixed-size values from the TLV payload without validating its length. A malformed IFE frame can declare a shorter payload, causing the decoders to consume bytes beyond the declared metadata value: [TLV type=IFE_META_SKBMARK len=4] -> dlen == 0, but decode reads 4 bytes The decoder may therefore set skb metadata from unintended input. Validate the payload length before decoding and return -EINVAL for invalid lengths. The caller treats decoder failures as per-TLV errors and continues decoding the remaining metadata. Fixes: 084e2f6566d2 ("Support to encoding decoding skb mark on IFE action") Fixes: 200e10f46936 ("Support to encoding decoding skb prio on IFE action") Fixes: 408fbc22ef1e ("net sched ife action: Introduce skb tcindex metadata encap decap") Assisted-by: Hawkeye:GLM-5.3-flash Assisted-by: Qoder:Qwen3.8-Max Signed-off-by: Fang Xieyan --- Found by auditing the IFE decode path at v6.18-rc7. The malformed metadata cases were reproduced with a userspace sanitizer model of the decode path, which reported reads of size 4/2 for dlen values smaller than the expected metadata size. Compile-tested on x86_64 with defconfig and NET_ACT_IFE=y: act_ife.o and the three act_meta_*.o build warning-free. net/sched/act_meta_mark.c | 6 +++++- net/sched/act_meta_skbprio.c | 6 +++++- net/sched/act_meta_skbtcindex.c | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/net/sched/act_meta_mark.c b/net/sched/act_meta_mark.c index ea0573cb8b2d..3a7d568df0da 100644 --- a/net/sched/act_meta_mark.c +++ b/net/sched/act_meta_mark.c @@ -28,8 +28,12 @@ static int skbmark_encode(struct sk_buff *skb, void *skbdata, static int skbmark_decode(struct sk_buff *skb, void *data, u16 len) { - u32 ifemark = *(u32 *)data; + u32 ifemark; + if (len != sizeof(ifemark)) + return -EINVAL; + + ifemark = *(u32 *)data; skb->mark = ntohl(ifemark); return 0; } diff --git a/net/sched/act_meta_skbprio.c b/net/sched/act_meta_skbprio.c index 2df3133ce5ad..fa4ba4269ca0 100644 --- a/net/sched/act_meta_skbprio.c +++ b/net/sched/act_meta_skbprio.c @@ -33,8 +33,12 @@ static int skbprio_encode(struct sk_buff *skb, void *skbdata, static int skbprio_decode(struct sk_buff *skb, void *data, u16 len) { - u32 ifeprio = *(u32 *)data; + u32 ifeprio; + if (len != sizeof(ifeprio)) + return -EINVAL; + + ifeprio = *(u32 *)data; skb->priority = ntohl(ifeprio); return 0; } diff --git a/net/sched/act_meta_skbtcindex.c b/net/sched/act_meta_skbtcindex.c index 44547caead46..48f001ada8f6 100644 --- a/net/sched/act_meta_skbtcindex.c +++ b/net/sched/act_meta_skbtcindex.c @@ -28,8 +28,12 @@ static int skbtcindex_encode(struct sk_buff *skb, void *skbdata, static int skbtcindex_decode(struct sk_buff *skb, void *data, u16 len) { - u16 ifetc_index = *(u16 *)data; + u16 ifetc_index; + if (len != sizeof(ifetc_index)) + return -EINVAL; + + ifetc_index = *(u16 *)data; skb->tc_index = ntohs(ifetc_index); return 0; } -- 2.50.1