> -----Original Message-----
> From: Ren Wei <[email protected]>
> Sent: Saturday, September 26, 2026 8:23 PM
> To: [email protected]; [email protected]
> Cc: [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]; [email protected]; Nguyen, Anthony L
> <[email protected]>; Kitszel, Przemyslaw
> <[email protected]>; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected]
> Subject: [PATCH net v1 2/2] i40e: validate TCP header before ATR
> access
>
> From: Zixuan Chai <[email protected]>
>
> i40e_atr() uses ipv6_find_hdr() to locate the TCP header. A successful
> protocol match does not verify that the complete TCP header is present
> in the skb, so dereferencing the result can access data beyond the
> packet.
>
> Check that the complete TCP header is available before inspecting it.
>
> Fixes: fd0a05ce74ef ("i40e: transmit, receive, and NAPI")
> Cc: [email protected]
> Reported-by: Florian Westphal <[email protected]>
> Closes: https://lore.kernel.org/netfilter-
> devel/[email protected]/
> Assisted-by: LLM
> Signed-off-by: Zixuan Chai <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---
> drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
> b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
> index ef5e657816f0..cdac279b8aed 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
> @@ -2911,6 +2911,9 @@ static void i40e_atr(struct i40e_ring *tx_ring,
> struct sk_buff *skb,
>
> if (l4_proto != IPPROTO_TCP)
> return;
> + if (unlikely(skb_tail_pointer(skb) < hdr.network + hlen +
> + sizeof(struct tcphdr)))
> + return;
>
> th = (struct tcphdr *)(hdr.network + hlen);
>
> --
> 2.34.1
Reviewed-by: Aleksandr Loktionov <[email protected]>
