Re: [PATCH net] net: guard timestamp cmsgs to real error queue skbs

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Kyle Zeng wrote:
> skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
> from sk_error_queue. That assumption is not true for AF_PACKET sockets:
> outgoing packet taps are also delivered to packet sockets with
> skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
> instead of struct sock_exterr_skb.
> 
> If such an skb is received with timestamping enabled, the generic
> timestamp cmsg path can read AF_PACKET control-buffer state as
> sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
> counter overlaps opt_stats. An odd drop count makes the path emit
> SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
> skbs this copies past the linear head and can trigger hardened usercopy or
> disclose adjacent heap contents.
> 
> Keep skb_is_err_queue() local to net/socket.c, but make it verify that
> the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
> installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
> receive ownership and no longer pass as error-queue skbs, while legitimate
> sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
> ownership.
> 
> Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>