🛡️ Sentinel: [CRITICAL] Fix out-of-bounds memory read in packet transmission

[maxugly]

🚨 Severity: CRITICAL
💡 Vulnerability: The sim_tx_packet() function in module/nata_blk.c used memcpy() to copy skb->len bytes from skb->data. For nonlinear skbs, skb->data only contains skb_headlen() bytes, potentially causing an out-of-bounds read.
🎯 Impact: This could leak arbitrary kernel memory into the transmitted payload or cause a kernel panic if the read reaches an unmapped page.
🔧 Fix: Replaced memcpy() with skb_copy_bits(), which safely handles nonlinear fragments and copies all the requested data correctly.
✅ Verification: Review the source changes. The kernel module builds successfully, though test environments lack the required headers for full testing.

---

PR created automatically by Jules for task 16361810257776929854 started by @maxugly

Summary by CodeRabbit

• Bug Fixes
  • Improved packet handling for non-linear network data.
  • Prevented invalid memory reads when copying packet contents.
  • Added error handling to stop incomplete packets from being published.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 147cb125-a3f5-41de-95ab-77cf461a6309

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5b3ed and 0e75961.

📒 Files selected for processing (2)

• .jules/sentinel.md
• module/nata_blk.c

---

📝 Walkthrough

Walkthrough

The transmit path now uses skb_copy_bits() for skb payloads. Copy failures return -EINVAL before header writing or slot publication. Sentinel documentation records the nonlinear skb safety rule.

Changes

skb payload safety

Layer / File(s)	Summary
Safe payload copy in sim_tx_packet module/nata_blk.c, .jules/sentinel.md	sim_tx_packet uses skb_copy_bits() and returns -EINVAL when copying fails. The Sentinel entry documents skb_headlen(skb), skb->len, and the required safe-copy API.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• maxugly/nata#1: Both changes modify sim_tx_packet buffer handling.
• maxugly/nata#27: Both changes replace unsafe skb copying with skb_copy_bits().
• maxugly/nata#29: Both changes update sim_tx_packet() to use skb_copy_bits() for payload copying.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the critical out-of-bounds read fix in packet transmission, which matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel-skb-oob-read-16361810257776929854

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}