[PATCH net v2 0/2] ipv4: do not write shared IP options when sending ICMP errors

[Eric Dumazet <edumazet@kernel.org>]

__ip_options_compile() updates Record Route and Timestamp options in
place. Two callers recompile options on an skb that can be a clone
sharing its data with other skbs, and thus write into shared packet
data:

 - ipv4_send_dest_unreach(), called from ipv4_link_failure()
 - cipso_v4_error(), called from the LSM socket receive hooks

If clones are processed concurrently, an option pointer can change
after it has been checked, corrupting the next option's length, which
__ip_options_echo() then trusts when building the ICMP reply.

Patch 1 recompiles the options on a private pskb_copy(), because
callers of dst_link_failure() keep pointers into skb->head.
Patch 2 unclones the skb, as ip_rcv_options() already does.
The two patches are independent.

The issues were reported by Kyle Zeng and found by an AI code review
agent. They were not reproduced, and the fixes were only build-tested.

v2:
 - patch 1: use pskb_copy() instead of skb_unclone(), since callers of
   dst_link_failure() such as ip_tunnel_xmit() cache pointers into
   skb->head across the call (Sashiko).
 - patch 2: no change.

v1: https://lore.kernel.org/netdev/20261106234313.2537882-1-edumazet@kernel.org/

Eric Dumazet (2):
  ipv4: recompile IP options on a private copy in
    ipv4_send_dest_unreach()
  cipso: unshare headers before recompiling IP options in
    cipso_v4_error()

 net/ipv4/cipso_ipv4.c |  3 +++
 net/ipv4/route.c      | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)


base-commit: 1d5e2c57e9ffc134e14b3f837c8d7c53b508bd22
-- 
2.53.0