Re: [PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[Ido Schimmel <idosch@nvidia.com>]

On Sun, Oct 25, 2026 at 12:13:37PM +0100, Eric Dumazet wrote:
> reg_vif_xmit() hands the skb to ipmr_cache_report() as an
> IGMPMSG_WHOLEPKT report. When the mroute socket has IP_PKTINFO
> enabled, ipmr_cache_report() calls ipv4_pktinfo_prepare() on the
> original skb, which reads skb->cb[] as IPCB.
> 
> By the time the pimreg device transmits the packet, skb->cb[] is not
> IPCB anymore: qdisc_pkt_len_init() overwrites IPCB(skb)->iif with
> qdisc_skb_cb(skb)->pkt_len, and any qdisc installed on the device or a
> tc BPF program writing skb->cb[] fills the area holding the IP options
> and IPCB(skb)->flags.
> 
> For locally generated packets routed out pimreg (they carry an rtable
> dst), the mroute socket can therefore receive a bogus ipi_ifindex
> (the packet length), and the l3mdev slave test in
> ipv4_pktinfo_prepare() is driven by stale qdisc data.
> 
> Clear IPCB before building the report, as done for IPv6 in
> commit 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").
> The skb is freed right after, so nothing else depends on its control
> block.
> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>