[PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[Qihang]

cipso_v4_delopt() recomputes the option length by walking the option
buffer after the CIPSO option has been moved out.  The walk then reads
the stale bytes at the tail of the buffer as option data, and a crafted
setsockopt(IP_OPTIONS) buffer can make it treat one of them as an option
length, increasing opt->opt.optlen beyond the valid option data.

The corrupted length stays on the socket and is later used as the copy
length by getsockopt(IP_OPTIONS) and by the udp/raw/ping sendmsg paths,
where it exceeds the size of the buffers they copy into.

Compute the new length from the intact options before the move and
subtract the CIPSO length, and fill the padding with IPOPT_END.

Assisted-by: LLM
Fixes: 014ab19a69c32 ("selinux: Set socket NetLabel based on connection endpoint")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
---
v4:
 - rebased onto net (fcc00b15cb21a)
 - reworded the impact paragraph only, no functional change
 - first public posting (v1-v3 were reviewed privately)

 net/ipv4/cipso_ipv4.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 1aacbbeffbc64..e65a3f29d2caf 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2013,6 +2013,10 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
 		cipso_ptr = &opt->opt.__data[cipso_off];
 		cipso_len = cipso_ptr[1];
 
+		optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data,
+							 opt->opt.optlen);
+		optlen_new -= cipso_len;
+
 		if (opt->opt.srr > opt->opt.cipso)
 			opt->opt.srr -= cipso_len;
 		if (opt->opt.rr > opt->opt.cipso)
@@ -2026,11 +2030,12 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
 		memmove(cipso_ptr, cipso_ptr + cipso_len,
 			opt->opt.optlen - cipso_off - cipso_len);
 
-		optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data,
-							 opt->opt.optlen);
 		hdr_delta = opt->opt.optlen;
 		opt->opt.optlen = (optlen_new + 3) & ~3;
 		hdr_delta -= opt->opt.optlen;
+
+		memset(&opt->opt.__data[optlen_new], IPOPT_END,
+		       opt->opt.optlen - optlen_new);
 	} else {
 		/* only the cipso option was present on the socket so we can
 		 * remove the entire option struct */

base-commit: fcc00b15cb21a6de76826e5012b2c758505f5e65
-- 
2.54.0 (Apple Git-157)

Re: [PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[sashiko-bot]

> cipso_v4_delopt() recomputes the option length by walking the option
> buffer after the CIPSO option has been moved out.  The walk then reads
> the stale bytes at the tail of the buffer as option data, and a crafted
> setsockopt(IP_OPTIONS) buffer can make it treat one of them as an option
> length, increasing opt->opt.optlen beyond the valid option data.
> 
> The corrupted length stays on the socket and is later used as the copy
> length by getsockopt(IP_OPTIONS) and by the udp/raw/ping sendmsg paths,
> where it exceeds the size of the buffers they copy into.
> 
> Compute the new length from the intact options before the move and
> subtract the CIPSO length, and fill the padding with IPOPT_END.
> 
> Assisted-by: LLM
> Fixes: 014ab19a69c32 ("selinux: Set socket NetLabel based on connection endpoint")
> Cc: stable@vger.kernel.org
> Signed-off-by: Qihang <q.h.hack.winter@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029033942.3644-1-q.h.hack.winter@gmail.com?part=1

Re: [PATCH net v4] cipso: fix optlen corruption in cipso_v4_delopt()

[Paul Moore]

On Wed, Oct 28, 2026 at 11:39 PM Qihang <q.h.hack.winter@gmail.com> wrote:
>
> cipso_v4_delopt() recomputes the option length by walking the option
> buffer after the CIPSO option has been moved out.  The walk then reads
> the stale bytes at the tail of the buffer as option data, and a crafted
> setsockopt(IP_OPTIONS) buffer can make it treat one of them as an option
> length, increasing opt->opt.optlen beyond the valid option data.
>
> The corrupted length stays on the socket and is later used as the copy
> length by getsockopt(IP_OPTIONS) and by the udp/raw/ping sendmsg paths,
> where it exceeds the size of the buffers they copy into.
>
> Compute the new length from the intact options before the move and
> subtract the CIPSO length, and fill the padding with IPOPT_END.
>
> Assisted-by: LLM
> Fixes: 014ab19a69c32 ("selinux: Set socket NetLabel based on connection endpoint")
> Cc: stable@vger.kernel.org
> Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
> ---
> v4:
>  - rebased onto net (fcc00b15cb21a)
>  - reworded the impact paragraph only, no functional change
>  - first public posting (v1-v3 were reviewed privately)
>
>  net/ipv4/cipso_ipv4.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)

Thanks!

Acked-by: Paul Moore <paul@paul-moore.com>

-- 
paul-moore.com