🛡️ Sentinel: [CRITICAL] Fix out-of-bounds read in non-linear sk_buff processing

[maxugly]

🚨 Severity: CRITICAL
💡 Vulnerability: The NATA kernel module used memcpy directly with skb->data and skb->len to copy payload data from an sk_buff into the ring buffer slot (sim_tx_packet). If an sk_buff is non-linear (fragmented), skb->data only points to the linear header portion, but skb->len encompasses the full size, leading to an out-of-bounds kernel memory read.
🎯 Impact: Out-of-bounds kernel memory reads can lead to kernel crashes (denial of service) or potentially expose sensitive kernel memory contents.
🔧 Fix: Replaced the unsafe memcpy with the kernel's skb_copy_bits() API, which securely handles both linear and non-linear sk_buff structures, ensuring all fragments are copied correctly without out-of-bounds access.
✅ Verification: The module was checked for correctness. (Full testing in sandbox environment was limited due to missing kernel headers).

---

PR created automatically by Jules for task 13370469961533673023 started by @maxugly

Summary by CodeRabbit

• Bug Fixes
  • Improved packet handling for fragmented or non-linear network buffers.
  • Prevented potential out-of-bounds memory reads during packet transmission.
  • Transmission now reports an error when packet data cannot be copied safely.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b01880c-9791-4ddb-b7d2-03542e1ca91a

📥 Commits

Reviewing files that changed from the base of the PR and between 6d5b3ed and d98bf02.

📒 Files selected for processing (2)

• .jules/sentinel.md
• module/nata_blk.c

---

📝 Walkthrough

Walkthrough

sim_tx_packet now copies non-linear sk_buff data with skb_copy_bits() and returns -EFAULT on failure. The change also adds a security entry documenting the previous out-of-bounds read.

Changes

Packet copy safety

Layer / File(s)	Summary
Safe packet copying and vulnerability record module/nata_blk.c, .jules/sentinel.md	sim_tx_packet uses skb_copy_bits() for fragmented data and handles copy failures. The security record documents the unsafe memcpy use and its prevention.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• maxugly/nata#27: Replaces unsafe memcpy in sim_tx_packet and documents the same vulnerability.
• maxugly/nata#29: Updates sim_tx_packet() to use skb_copy_bits() for non-linear sk_buff data.
• maxugly/nata#41: Uses skb_copy_bits() and handles copy failures in sim_tx_packet.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the fix for the out-of-bounds read in non-linear sk_buff processing.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel/fix-skb-memcpy-oob-13370469961533673023

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}