From e8be7cdedc41ff28876d66b566770929d03acbb8 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:25 -0700 Subject: [PATCH] net/sched: netem: handle multi-segment skb in corruption The packet corruption code only flipped bits in the linear header portion of the skb, skipping corruption when skb_headlen() was zero. Linearize the whole skb if necessary before corruption. Extends d64cb81dcbd5 ("net/sched: sch_netem: fix out-of-bounds access in packet corruption") with a more general solution. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-5-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- net/sched/sch_netem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 7570bcb10a15..1e9de2ba8891 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -513,16 +513,17 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, qdisc_qstats_drop(sch); goto finish_segs; } - if (skb->ip_summed == CHECKSUM_PARTIAL && - skb_checksum_help(skb)) { + if (skb_linearize(skb) || + (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_help(skb))) { qdisc_drop(skb, sch, to_free); skb = NULL; goto finish_segs; } - if (skb_headlen(skb)) - skb->data[get_random_u32_below(skb_headlen(skb))] ^= - 1 << get_random_u32_below(8); + if (skb->len) { + u32 offset = get_random_u32_below(skb->len); + skb->data[offset] ^= 1 << get_random_u32_below(8); + } } if (unlikely(sch->q.qlen >= sch->limit)) {