phonet: pep: fix use-after-free in pep_get_sb()

pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
the skb data, and continue to access the older pointer, causing UAF.

Reproduced under KASAN:

  BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
  Read of size 1 at addr ff11000105510f50 by task repro/157
   pep_get_sb+0x234/0x3b0
   pipe_handler_do_rcv+0x5f7/0xa10
   pep_do_rcv+0x203/0x410
   __sk_receive_skb+0x471/0x4a0
   phonet_rcv+0x5b3/0x6c0
   __netif_receive_skb+0xcc/0x1d0

Refetch the header with skb_header_pointer() after pskb_may_pull(), so
the possibly stale pointer is no longer dereferenced. There are better
ways to solve this, but, this is the less instrusive one.

Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260721-phonet_get_sb_uaf-v1-1-95fd7881cc4e@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7069271393933e4ea899ca27050af64b0bf99111..31b29e3ca7bc610d697c935dc633434357dd8c33 100644 (file)
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -55,6 +55,8 @@ static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
        ph = skb_header_pointer(skb, 0, 2, &h);
        if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
                return NULL;
+       /* pskb_may_pull() may have reallocated the head; refetch ph. */
+       ph = skb_header_pointer(skb, 0, 2, &h);
        ph->sb_len -= 2;
        *ptype = ph->sb_type;
        *plen = ph->sb_len;