Commit 0f71f852a96a for kernel

commit 0f71f852a96af9685858ce59fda34ecbf85c283d
Author: Breno Leitao <leitao@debian.org>
Date:   Tue Jul 21 01:58:45 2026 -0700

    phonet: pep: fix use-after-free in pep_get_sb()

    pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
    the skb data, and continue to access the older pointer, causing UAF.

    Reproduced under KASAN:

      BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
      Read of size 1 at addr ff11000105510f50 by task repro/157
       pep_get_sb+0x234/0x3b0
       pipe_handler_do_rcv+0x5f7/0xa10
       pep_do_rcv+0x203/0x410
       __sk_receive_skb+0x471/0x4a0
       phonet_rcv+0x5b3/0x6c0
       __netif_receive_skb+0xcc/0x1d0

    Refetch the header with skb_header_pointer() after pskb_may_pull(), so
    the possibly stale pointer is no longer dereferenced. There are better
    ways to solve this, but, this is the less instrusive one.

    Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
    Cc: stable@vger.kernel.org
    Signed-off-by: Breno Leitao <leitao@debian.org>
    Link: https://patch.msgid.link/20260721-phonet_get_sb_uaf-v1-1-95fd7881cc4e@debian.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 706927139393..31b29e3ca7bc 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -55,6 +55,8 @@ static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
 	ph = skb_header_pointer(skb, 0, 2, &h);
 	if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
 		return NULL;
+	/* pskb_may_pull() may have reallocated the head; refetch ph. */
+	ph = skb_header_pointer(skb, 0, 2, &h);
 	ph->sb_len -= 2;
 	*ptype = ph->sb_type;
 	*plen = ph->sb_len;