Re: [PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[sashiko-bot@kernel.org]

> cipso_v4_delopt() recomputes the option length by walking the option
> buffer after the CIPSO option has been moved out.  The walk then reads
> the stale bytes at the tail of the buffer as option data, and a crafted
> setsockopt(IP_OPTIONS) buffer can make it treat one of them as an option
> length, increasing opt->opt.optlen beyond the valid option data.
> 
> The corrupted length stays on the socket and is later used as the copy
> length by getsockopt(IP_OPTIONS) and by the udp/raw/ping sendmsg paths,
> where it exceeds the size of the buffers they copy into.
> 
> Compute the new length from the intact options before the move and
> subtract the CIPSO length, and fill the padding with IPOPT_END.
> 
> Assisted-by: LLM
> Fixes: 014ab19a69c32 ("selinux: Set socket NetLabel based on connection endpoint")
> Cc: stable@vger.kernel.org
> Signed-off-by: Qihang <q.h.hack.winter@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029033942.3644-1-q.h.hack.winter@gmail.com?part=1