Re: [PATCH net 0/2] ipmr, ip6mr: Fix several info leaks

[Hangbin Liu <hangbin.liu@linux.dev>]

On Sun, Oct 25, 2026 at 09:17:27AM +0200, Ido Schimmel wrote:
> ip{,6}mr_cache_report() copy the IP header of a packet that triggered an
> upcall to a report packet that is delivered to user space. The header
> is not always fully initialized or present, resulting in info leaks
> flagged by KMSAN.
> 
> Patch 1 fixes an info leak in the RTM_GETROUTE path, caused by the fact
> that ipmr_get_route() does not fully initialize the IP header of the
> packet that it creates. IPv6 does not suffer from this problem.
> 
> Patch 2 fixes info leaks triggered by packets injected into pim{,6}reg
> devices via AF_PACKET sockets. The kernel does not validate that these
> are IP packets that carry an IP header before calling
> ip{,6}mr_cache_report().
> 
> Both issues were reported by Sashiko and reproduced by me. See KMSAN
> traces in the commit messages.
> 
> As far as I can tell, all other callers call these functions from the IP
> input / output paths and therefore provide a valid IP packet, with the
> exception of ip6mr_get_route() which fully initializes the header of the
> packet it creates.
> 
> Ido Schimmel (2):
>   ipmr: fully initialize the synthetic IP header in ipmr_get_route()
>   ipmr, ip6mr: validate packets injected into the register vif on xmit
> 
>  net/ipv4/ipmr.c  | 7 +++++++
>  net/ipv6/ip6mr.c | 2 +-
>  2 files changed, 8 insertions(+), 1 deletion(-)
> 
> -- 
> 2.56.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>