Re: [PATCH net 1/1] ipmr: only copy pktinfo to cache reports

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Jul 28, 2026 at 12:44:49AM +0800, Ren Wei wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> ipmr_cache_report() builds short IGMP reports for mrouted from a packet
> that may be a synthetic RTM_GETROUTE query. That query skb stores the
> netlink requester portid in NETLINK_CB(), but the report is delivered to
> a raw IPv4 socket, whose receive path interprets skb->cb as IPCB().
> 
> Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP
> msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the
> original packet and then copying the whole control buffer to the report
> skb. For synthetic route-query packets, this copies NETLINK_CB bytes

It's copying 48 bytes, which is the size of the control block. Please reword.

> into IPCB and lets a controlled portid corrupt IPCB(skb)->opt. With
> IP_RECVOPTS or IP_RETOPTS enabled, the raw socket receive path can then
> copy past the short report packet or overflow the stack option buffer.
> 
> Keep the IP_PKTINFO support, but initialize the report skb control buffer
> and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare().

This can break IP_RECVOPTS and IP_RETOPTS on the mrouted socket, but
this was never meant to work (side effect of bb7403655b3c) and therefore
unlikely to cause any regressions. Please mention this in the commit
message.

> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.6-terra
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> Signed-off-by: Ren Wei <enjou1224z@gmail.com>
> ---
>  net/ipv4/ipmr.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index 1d9a4ac14fcef..783de5de02ddd 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -1061,6 +1061,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
> +	struct in_pktinfo *info;
>  	struct sock *mroute_sk;
>  	struct igmphdr *igmp;
>  	struct igmpmsg *msg;
>  	struct sk_buff *skb;
>  	int ret;
>  
> @@ -1113,7 +1114,10 @@ static int ipmr_cache_report(const struct mr_table *mrt,
>  		msg->im_vif = vifi;
>  		msg->im_vif_hi = vifi >> 8;
>  		ipv4_pktinfo_prepare(mroute_sk, pkt, false);
> -		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
> +		info = PKTINFO_SKB_CB(skb);
> +		memset(skb->cb, 0, sizeof(skb->cb));
> +		info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
> +		info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
>  		/* Add our header.
>  		 * Note that code, csum and group fields are cleared.
>  		 */

I believe that Sashiko is correct and there is a similar problem with
the other branch:

https://sashiko.dev/#/patchset/5bc7cd71c2d671b305f25497d88ae8a0aa663c08.1784894076.git.zhilinz%40nebusec.ai

This should fix both:

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1d9a4ac14fce..4827973c6f9c 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1058,6 +1058,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 			     struct sk_buff *pkt, vifi_t vifi, int assert)
 {
 	const int ihl = ip_hdrlen(pkt);
+	struct in_pktinfo *info;
 	struct sock *mroute_sk;
 	struct igmphdr *igmp;
 	struct igmpmsg *msg;
@@ -1112,8 +1113,6 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 		msg = (struct igmpmsg *)skb_network_header(skb);
 		msg->im_vif = vifi;
 		msg->im_vif_hi = vifi >> 8;
-		ipv4_pktinfo_prepare(mroute_sk, pkt, false);
-		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
 		/* Add our header.
 		 * Note that code, csum and group fields are cleared.
 		 */
@@ -1124,6 +1123,12 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 		skb->transport_header = skb->network_header;
 	}
 
+	ipv4_pktinfo_prepare(mroute_sk, pkt, false);
+	memset(skb->cb, 0, sizeof(skb->cb));
+	info = PKTINFO_SKB_CB(skb);
+	info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
+	info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
+
 	igmpmsg_netlink_event(mrt, skb);
 
 	/* Deliver to mrouted */