From b8ec6b84c199281a2bf690d5defb08b5a3cdd33c Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 18 Jun 2026 01:08:06 -0700 Subject: [PATCH] net: add skb_header_pointer_careful() helper [ Upstream commit 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 ] This variant of skb_header_pointer() should be used in contexts where @offset argument is user-controlled and could be negative. Negative offsets are supported, as long as the zone starts between skb->head and skb->data. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com Signed-off-by: Jakub Kicinski [ Adjust context ] Signed-off-by: Bin Lan Signed-off-by: Greg Kroah-Hartman [ Shivani: Modified to apply on 5.10.y ] Signed-off-by: Shivani Agarwal Signed-off-by: Sasha Levin Signed-off-by: Ulrich Hecht --- include/linux/skbuff.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index d6922ac2da7f..84557050013d 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -3459,6 +3459,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer) skb_headlen(skb), buffer); } +/* Variant of skb_header_pointer() where @offset is user-controlled + * and potentially negative. + */ +static inline void * __must_check +skb_header_pointer_careful(const struct sk_buff *skb, int offset, + int len, void *buffer) +{ + if (unlikely(offset < 0 && -offset > skb_headroom(skb))) + return NULL; + return skb_header_pointer(skb, offset, len, buffer); +} + /** * skb_needs_linearize - check if we need to linearize a given skb * depending on the given device features.