Re: [PATCH ipsec v2] xfrm4: use a full socket for local errors

[Steffen Klassert <steffen.klassert@secunet.com>]

On Thu, Oct 22, 2026 at 10:26:22AM +0800, Fourie Zhang wrote:
> From: Fourie Zhang <fouriezhang@tencent.com>
> 
> xfrm4_local_error() passes skb->sk to inet_sk() and ip_local_error()
> without ensuring it points to a full socket. TCP SYN-ACK skbs can be owned
> by TCP_NEW_SYN_RECV request sockets.
> 
> xfrm4_tunnel_check_size() already checks sk_fullsock() since commit
> 1620c88887b1 ("xfrm: Fix the usage of skb->sk"), so iptfs_is_too_big() is
> the only remaining IPv4 caller passing a request socket here: the sk it
> tests is the listener, while skb->sk is the request socket.
> 
> When IP-TFS rejects such an skb because it exceeds its payload MTU, the
> local error path treats the request socket as a struct inet_sock. KASAN
> reports a slab-out-of-bounds read in ip_local_error() beyond the
> request_sock_TCP allocation.
> 
> Resolve the skb owner with skb_to_full_sk() before accessing inet_sock
> state or reporting the error. This maps a request socket to its listener
> and rejects sockets that cannot be used as full sockets, matching what
> commit 6973a21ee73c ("ipv6: xfrm: use full sockets in local error paths")
> did for xfrm6_local_error().
> 
> Fixes: 0e4fbf013fa5 ("xfrm: iptfs: add user packet (tunnel ingress) handling")
> Cc: stable@vger.kernel.org
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> Link: https://lore.kernel.org/netdev/20260908224856.1591189-1-kuba@kernel.org/
> Reviewed-by: Eric Dumazet <edumazet@kernel.org>
> Assisted-by: tencentos-corvus-ai:hy4-preview
> Signed-off-by: Fourie Zhang <fouriezhang@tencent.com>

Applied, thanks a lot!