[PATCH net 0/2] ipv4: unclone skbs before recompiling IP options

[Eric Dumazet <edumazet@kernel.org>]

__ip_options_compile() updates Record Route and Timestamp options in
place. Two callers recompile options on an skb that can be a clone
sharing its data with other skbs, and thus write into shared packet
data:

 - ipv4_send_dest_unreach(), called from ipv4_link_failure()
 - cipso_v4_error(), called from the LSM socket receive hooks

If clones are processed concurrently, an option pointer can change
after it has been checked, corrupting the next option's length, which
__ip_options_echo() then trusts when building the ICMP reply.

Both patches unclone the skb before recompiling the options, as
ip_rcv_options() already does. The two patches are independent.

The issues were reported by Kyle Zeng and found by an AI code review
agent. They were not reproduced, and the fixes were only build-tested.

Eric Dumazet (2):
  ipv4: unshare headers before recompiling IP options in
    ipv4_send_dest_unreach()
  cipso: unshare headers before recompiling IP options in
    cipso_v4_error()

 net/ipv4/cipso_ipv4.c | 3 +++
 net/ipv4/route.c      | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)


base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
-- 
2.53.0