[PATCH net v2 1/1] ipmr: only copy pktinfo to cache reports

[PATCH net v2 1/1] ipmr: only copy pktinfo to cache reports

[Zhiling Zou]

ipmr_cache_report() builds reports for mrouted from a packet that may be a
synthetic RTM_GETROUTE query. That query skb stores the netlink requester
portid in NETLINK_CB(), but the report is delivered to a raw IPv4 socket,
whose receive path interprets skb->cb as IPCB().

Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP
msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the
original packet and then copying the entire 48-byte skb control block to
the report skb. For synthetic route-query packets, this copies
NETLINK_CB() bytes into IPCB() and lets a controlled portid corrupt
IPCB(skb)->opt. With IP_RECVOPTS or IP_RETOPTS enabled, the raw socket
receive path can then copy past the short report packet or overflow the
stack option buffer.

Keep the IP_PKTINFO support, but initialize the report skb control buffer
and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare(). Do
this in the common path so both short reports and whole-packet reports are
covered.

This removes the accidental IP_RECVOPTS/IP_RETOPTS behavior on the
mrouted socket, but that behavior was only a side effect of copying the
entire control block and was never intended to work for these reports.

Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
---
changes in v2:
- reword the commit message to say the entire 48-byte skb control block is copied
- mention that IP_RECVOPTS/IP_RETOPTS on the mrouted socket was never intended
- move the pktinfo copy to the common path so both report branches are covered
- v1 Link: https://lore.kernel.org/all/5bc7cd71c2d671b305f25497d88ae8a0aa663c08.1784894076.git.zhilinz@nebusec.ai/

 net/ipv4/ipmr.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1d9a4ac14fcef..4827973c6f9c0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1058,6 +1058,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 			     struct sk_buff *pkt, vifi_t vifi, int assert)
 {
 	const int ihl = ip_hdrlen(pkt);
+	struct in_pktinfo *info;
 	struct sock *mroute_sk;
 	struct igmphdr *igmp;
 	struct igmpmsg *msg;
@@ -1112,8 +1113,6 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 		msg = (struct igmpmsg *)skb_network_header(skb);
 		msg->im_vif = vifi;
 		msg->im_vif_hi = vifi >> 8;
-		ipv4_pktinfo_prepare(mroute_sk, pkt, false);
-		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
 		/* Add our header.
 		 * Note that code, csum and group fields are cleared.
 		 */
@@ -1124,6 +1123,12 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 		skb->transport_header = skb->network_header;
 	}
 
+	ipv4_pktinfo_prepare(mroute_sk, pkt, false);
+	memset(skb->cb, 0, sizeof(skb->cb));
+	info = PKTINFO_SKB_CB(skb);
+	info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
+	info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
+
 	igmpmsg_netlink_event(mrt, skb);
 
 	/* Deliver to mrouted */
-- 
2.43.0

Re: [PATCH net v2 1/1] ipmr: only copy pktinfo to cache reports

[Ido Schimmel]

On Thu, Jul 30, 2026 at 11:17:07AM +0800, Zhiling Zou wrote:
> ipmr_cache_report() builds reports for mrouted from a packet that may be a
> synthetic RTM_GETROUTE query. That query skb stores the netlink requester
> portid in NETLINK_CB(), but the report is delivered to a raw IPv4 socket,
> whose receive path interprets skb->cb as IPCB().
> 
> Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP
> msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the
> original packet and then copying the entire 48-byte skb control block to
> the report skb. For synthetic route-query packets, this copies
> NETLINK_CB() bytes into IPCB() and lets a controlled portid corrupt
> IPCB(skb)->opt. With IP_RECVOPTS or IP_RETOPTS enabled, the raw socket
> receive path can then copy past the short report packet or overflow the
> stack option buffer.
> 
> Keep the IP_PKTINFO support, but initialize the report skb control buffer
> and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare(). Do
> this in the common path so both short reports and whole-packet reports are
> covered.
> 
> This removes the accidental IP_RECVOPTS/IP_RETOPTS behavior on the
> mrouted socket, but that behavior was only a side effect of copying the
> entire control block and was never intended to work for these reports.
> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
> changes in v2:
> - reword the commit message to say the entire 48-byte skb control block is copied
> - mention that IP_RECVOPTS/IP_RETOPTS on the mrouted socket was never intended
> - move the pktinfo copy to the common path so both report branches are covered
> - v1 Link: https://lore.kernel.org/all/5bc7cd71c2d671b305f25497d88ae8a0aa663c08.1784894076.git.zhilinz@nebusec.ai/

Sashiko keeps complaining about more bugs with this code. I think it's
better to fix one bug at a time (with different Fixes tags). Let's go
back to v1, but please remove the memset() given alloc_skb() takes care
of clearing the control block. I will fix the remaining problems after
your patch is accepted.