Subject: Re: [PATCH bpf] bpf: Reject negative head_room in __bpf_skb_change_head

From: [email-masked]
Date: Tue, 28 Oct 2025 22:20:05 +0000

Hello:

This patch was applied to bpf/bpf.git (master)
by Martin KaFai Lau <[email-masked]>:

On Thu, 23 Oct 2025 14:55:32 +0200 you wrote:
> Yinhao et al. recently reported:
> 
>   Our fuzzing tool was able to create a BPF program which triggered
>   the below BUG condition inside pskb_expand_head.
> 
>   [   23.016047][T10006] kernel BUG at net/core/skbuff.c:2232!
>   [...]
>   [   23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530
>   [...]
>   [   23.021249][T10006] Call Trace:
>   [   23.021387][T10006]  <TASK>
>   [   23.021507][T10006]  ? __pfx_pskb_expand_head+0x10/0x10
>   [   23.021725][T10006]  __bpf_skb_change_head+0x22a/0x520
>   [   23.021939][T10006]  bpf_skb_change_head+0x34/0x1b0
>   [   23.022143][T10006]  ___bpf_prog_run+0xf70/0xb670
>   [   23.022342][T10006]  __bpf_prog_run32+0xed/0x140
>   [...]
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Reject negative head_room in __bpf_skb_change_head
    https://git.kernel.org/bpf/bpf/c/2cbb259ec4f8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html