From 40cb4cb77ea26d65156f0442c846d5f7ff497839 Mon Sep 17 00:00:00 2001 From: Will Rosenberg Date: Tue, 20 Jan 2026 08:57:38 -0700 Subject: [PATCH] cipso: harden use of skb_cow() in cipso_v4_skbuff_setattr() If skb_cow() is passed a headroom <= -NET_SKB_PAD, it will trigger a BUG. As a result, use cases should avoid calling with a headroom that is negative to prevent triggering this issue. This is the same code pattern fixed in Commit 58fc7342b529 ("ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()"). In cipso_v4_skbuff_setattr(), len_delta can become negative, leading to a negative headroom passed to skb_cow(). However, the BUG is not triggerable because the condition headroom <= -NET_SKB_PAD cannot be satisfied due to limits on the IPv4 options header size. Avoid potential problems in the future by only using skb_cow() to grow the skb headroom. Signed-off-by: Will Rosenberg Acked-by: Paul Moore Link: https://patch.msgid.link/20260120155738.982771-1-whrosenb@asu.edu Signed-off-by: Paolo Abeni --- net/ipv4/cipso_ipv4.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index 709021197e1ca..32b951ebc0c2b 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -2196,7 +2196,8 @@ int cipso_v4_skbuff_setattr(struct sk_buff *skb, /* if we don't ensure enough headroom we could panic on the skb_push() * call below so make sure we have enough, we are also "mangling" the * packet so we should probably do a copy-on-write call anyway */ - ret_val = skb_cow(skb, skb_headroom(skb) + len_delta); + ret_val = skb_cow(skb, + skb_headroom(skb) + (len_delta > 0 ? len_delta : 0)); if (ret_val < 0) return ret_val; -- 2.47.3