Re: [PATCH net] selftests: net: txtimestamp: fix out-of-bounds read in raw UDP checksum

[Hangbin Liu]

On Tue, Oct 27, 2026 at 09:29:45AM -0700, Jamie Nguyen wrote:
> With -r (SOCK_RAW, IPPROTO_UDP) the test writes only the UDP header and
> payload, and the kernel adds the IP header. get_udp_csum() still expects
> the IP source and destination addresses to directly precede the UDP
> header, and reads 2 * alen bytes before the start of the buffer: 8 bytes
> for IPv4, 32 bytes for IPv6.
> 
> ASan reports a heap-buffer-overflow for both -4 -r and -6 -r. Without
> ASan the read usually goes unnoticed, but it faults when the buffer is
> the first chunk in the heap. That happens on Ubuntu 26.04, where the
> kselftest runner wraps the test in uutils stdbuf, and txtimestamp.sh
> fails with SIGSEGV on every run.
> 
> Even without a crash, -r packets were sent with a checksum computed
> over unrelated heap memory, so their UDP checksum was invalid.
> 
> Build the pseudo-header from the destination address and checksum only
> the UDP header and payload. -R and -P already write daddr as both the
> source and destination address, so their checksums are unchanged. With
> -r the kernel selects the source address, which equals daddr for the
> loopback addresses used by txtimestamp.sh.
> 
> Fixes: b52354aa068e ("selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet")
> Signed-off-by: Jamie Nguyen <jamien@xxxxxxxxxx>
> ---
>  tools/testing/selftests/net/txtimestamp.c | 23 ++++++++++++++---------
>  1 file changed, 14 insertions(+), 9 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/txtimestamp.c b/tools/testing/selftests/net/txtimestamp.c
> index 170be19..f7bdf30 100644
> --- a/tools/testing/selftests/net/txtimestamp.c
> +++ b/tools/testing/selftests/net/txtimestamp.c
> @@ -418,19 +418,25 @@ static uint16_t get_ip_csum(const uint16_t *start, int num_words,
>  	return ~sum;
>  }
>  
> -static uint16_t get_udp_csum(const struct udphdr *udph, int alen)
> +static uint16_t get_udp_csum(const struct udphdr *udph, bool is_ipv4)
>  {
> -	unsigned long pseudo_sum, csum_len;
> -	const void *csum_start = udph;
> +	const void *addr = is_ipv4 ? (void *)&daddr.sin_addr : &daddr6.sin6_addr;
> +	int alen = is_ipv4 ? sizeof(struct in_addr) : sizeof(struct in6_addr);
> +	uint16_t addr16[sizeof(struct in6_addr) / sizeof(uint16_t)];
> +	unsigned long pseudo_sum;
> +	int i;
>  
>  	pseudo_sum = htons(IPPROTO_UDP);
>  	pseudo_sum += udph->len;
>  
> -	/* checksum ip(v6) addresses + udp header + payload */
> -	csum_start -= alen * 2;
> -	csum_len = ntohs(udph->len) + alen * 2;
> +	/* pseudo-header source and destination: both are daddr */
> +	memcpy(addr16, addr, alen);
> +	for (i = 0; i < alen / 2; i++)
> +		pseudo_sum += 2 * addr16[i];
>  
> -	return get_ip_csum(csum_start, csum_len >> 1, pseudo_sum);
> +	/* checksum udp header + payload */
> +	return get_ip_csum((const uint16_t *)udph, ntohs(udph->len) >> 1,
> +			   pseudo_sum);
>  }
>  
>  static int fill_header_ipv4(void *p)
> @@ -479,8 +485,7 @@ static void fill_header_udp(void *p, bool is_ipv4)
>  	udph->len    = ntohs(sizeof(*udph) + cfg_payload_len);
>  	udph->check  = 0;
>  
> -	udph->check  = get_udp_csum(udph, is_ipv4 ? sizeof(struct in_addr) :
> -						    sizeof(struct in6_addr));
> +	udph->check  = get_udp_csum(udph, is_ipv4);
>  }
>  
>  static void do_test(int family, unsigned int report_opt)
> -- 
> 2.43.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>