[PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[Dudu Lu]

report_sock_error() clones the transmitted skb, overlays a
struct sock_exterr_skb on its control block and fills in the seven
struct sock_extended_err fields, but never clears addr_offset and port.
skb_clone() copies cb[] verbatim, so the errqueue entry carries the TX
skb's stale control block to the receive side, and the ipv4 error-queue
reader trusts those bytes:

  net/ipv4/ip_sockglue.c:556
	sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
					   serr->addr_offset);
	sin->sin_port = serr->port;

The gate that is supposed to guard that read only asks whether an
address was requested at all:

  net/ipv4/ip_sockglue.c:484
	return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
	       serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port;

SO_EE_ORIGIN_TXTIME is neither ICMP nor LOCAL, so for sch_etf the gate is
decided by serr->port alone -- by the stale byte pair.  When it is
non-zero the reader dereferences skb_network_header() + addr_offset with
an arbitrary offset.  On the TCP path cb[40..44) is not zero: the
transmit path stored delivered_mstamp there (tcp_rate_skb_sent()), which
is exactly where addr_offset/port sit in the arm64 struct layout.

Reached with an unmodified 7.3-rc4 (arm64, KASAN, in-tree modules): a TCP
socket enables TX-timestamp error reporting (SO_TXTIME with
SOF_TXTIME_REPORT_ERRORS), a sch_etf qdisc drops the packet, and a
recvmsg() reaches ip_recv_error():

  BUG: KASAN: slab-out-of-bounds in ip_recv_error+0x970/0xa0c
  Read of size 4 at addr ffff0000158ffdd5 by task A-227-A227-1_S2/113
  ip_recv_error+0x970/0xa0c
  inet_recv_error+0x94/0xdc
  tcp_recvmsg+0x378/0x408
  ...
  The buggy address is located 149 bytes to the right of
  allocated 704-byte region

Zero the whole overlay rather than the two fields individually: the
errqueue entry is handed to the receive side as a self-contained record,
which is what every other producer in the tree already does (sch_etf was
the only error-queue producer that cleared neither field).  This does not
change what the in-tree selftest observes -- so_txtime.c reads only
ee_origin/ee_errno/ee_code/ee_data/ee_info, never msg_name or sin_port.

Fixes: 4b15c7075352 ("net/sched: Make etf report drops on error_queue")
Assisted-by: LLM
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
---
Tested base
-----------
Detected on Linux 7.3-rc4 (commit 93f51579e7df), arm64 QEMU guest.
Re-checked against mainline f47d223627f8 (v7.3-341): the affected code
is unchanged between the two, so the bug is still present there.
Checked against linux-next next-20261021 (commit 9a482184d910): the
affected code is unchanged there as well, so the bug is still present in
linux-next too.

Reproducer status
-----------------
A reproducer was written and executed on an arm64 QEMU guest (dummy-virt,
KASAN kernel) against unmodified 7.3-rc4 in-tree modules; KASAN fired at the
claimed sink.  The reproducer source is not posted here per
Documentation/process/security-bugs.rst ("do not publicly share a reproducer");
it is available on request.

Triggering conditions
---------------------
CAP_NET_ADMIN to install the etf qdisc; the socket must opt into TX
timestamp error reporting (SO_TXTIME + SOF_TXTIME_REPORT_ERRORS); a TCP flow
with a non-empty retransmit queue.  No out-of-tree module is needed.

Notes
-----
Built and checkpatch-clean: this patch was applied on top of 7.3-rc4
(commit 93f51579e7df) and a full arm64 kernel (defconfig) was built with
it -- no new warnings or errors.  scripts/checkpatch.pl reports 0 errors,
0 warnings.

 net/sched/sch_etf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c
index ada87a8..aaafcf6 100644
--- a/net/sched/sch_etf.c
+++ b/net/sched/sch_etf.c
@@ -147,6 +147,7 @@ static void report_sock_error(struct sk_buff *skb, u32 err, u8 code)
 		return;

 	serr = SKB_EXT_ERR(clone);
+	memset(serr, 0, sizeof(*serr));
 	serr->ee.ee_errno = err;
 	serr->ee.ee_origin = SO_EE_ORIGIN_TXTIME;
 	serr->ee.ee_type = 0;
--
2.39.5 (Apple Git-154)

Re: [PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[phx]

Hi, The issue was found by LLM-assisted review of this code path (static analysis), not from a production hit or a syzbot report. I then wrote a reproducer and ran it on an arm64 QEMU guest under KASAN; it fired at the claimed sink (ip_recv_error). The "Assisted-by: LLM" trailer reflects that assistance. Thanks.

> 2026年10月21日 下午11:58，netdev-bot+sinfo@kernel.org 写道：
> 
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
> - How the issue was discovered, e.g. hit in production, hit during
>   development, syzbot report, manual code inspection, LLM or static
>   analysis tool scan.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[Simon Horman]

On Wed, Oct 21, 2026 at 11:54:01PM +0800, Dudu Lu wrote:
> report_sock_error() clones the transmitted skb, overlays a
> struct sock_exterr_skb on its control block and fills in the seven
> struct sock_extended_err fields, but never clears addr_offset and port.
> skb_clone() copies cb[] verbatim, so the errqueue entry carries the TX
> skb's stale control block to the receive side, and the ipv4 error-queue
> reader trusts those bytes:
> 
>   net/ipv4/ip_sockglue.c:556
> 	sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
> 					   serr->addr_offset);
> 	sin->sin_port = serr->port;
> 
> The gate that is supposed to guard that read only asks whether an
> address was requested at all:
> 
>   net/ipv4/ip_sockglue.c:484
> 	return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
> 	       serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port;
> 
> SO_EE_ORIGIN_TXTIME is neither ICMP nor LOCAL, so for sch_etf the gate is
> decided by serr->port alone -- by the stale byte pair.  When it is
> non-zero the reader dereferences skb_network_header() + addr_offset with
> an arbitrary offset.  On the TCP path cb[40..44) is not zero: the
> transmit path stored delivered_mstamp there (tcp_rate_skb_sent()), which
> is exactly where addr_offset/port sit in the arm64 struct layout.
> 
> Reached with an unmodified 7.3-rc4 (arm64, KASAN, in-tree modules): a TCP
> socket enables TX-timestamp error reporting (SO_TXTIME with
> SOF_TXTIME_REPORT_ERRORS), a sch_etf qdisc drops the packet, and a
> recvmsg() reaches ip_recv_error():
> 
>   BUG: KASAN: slab-out-of-bounds in ip_recv_error+0x970/0xa0c
>   Read of size 4 at addr ffff0000158ffdd5 by task A-227-A227-1_S2/113
>   ip_recv_error+0x970/0xa0c
>   inet_recv_error+0x94/0xdc
>   tcp_recvmsg+0x378/0x408
>   ...
>   The buggy address is located 149 bytes to the right of
>   allocated 704-byte region
> 
> Zero the whole overlay rather than the two fields individually: the
> errqueue entry is handed to the receive side as a self-contained record,
> which is what every other producer in the tree already does (sch_etf was
> the only error-queue producer that cleared neither field).  This does not
> change what the in-tree selftest observes -- so_txtime.c reads only
> ee_origin/ee_errno/ee_code/ee_data/ee_info, never msg_name or sin_port.
> 
> Fixes: 4b15c7075352 ("net/sched: Make etf report drops on error_queue")
> Assisted-by: LLM
> Signed-off-by: Dudu Lu <phx0fer@gmail.com>
> ---
> Tested base
> -----------
> Detected on Linux 7.3-rc4 (commit 93f51579e7df), arm64 QEMU guest.
> Re-checked against mainline f47d223627f8 (v7.3-341): the affected code
> is unchanged between the two, so the bug is still present there.
> Checked against linux-next next-20261021 (commit 9a482184d910): the
> affected code is unchanged there as well, so the bug is still present in
> linux-next too.
> 
> Reproducer status
> -----------------
> A reproducer was written and executed on an arm64 QEMU guest (dummy-virt,
> KASAN kernel) against unmodified 7.3-rc4 in-tree modules; KASAN fired at the
> claimed sink.  The reproducer source is not posted here per
> Documentation/process/security-bugs.rst ("do not publicly share a reproducer");
> it is available on request.
> 
> Triggering conditions
> ---------------------
> CAP_NET_ADMIN to install the etf qdisc; the socket must opt into TX
> timestamp error reporting (SO_TXTIME + SOF_TXTIME_REPORT_ERRORS); a TCP flow
> with a non-empty retransmit queue.  No out-of-tree module is needed.
> 
> Notes
> -----
> Built and checkpatch-clean: this patch was applied on top of 7.3-rc4
> (commit 93f51579e7df) and a full arm64 kernel (defconfig) was built with
> it -- no new warnings or errors.  scripts/checkpatch.pl reports 0 errors,
> 0 warnings.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 21 Oct 2026 23:54:01 +0800 you wrote:
> report_sock_error() clones the transmitted skb, overlays a
> struct sock_exterr_skb on its control block and fills in the seven
> struct sock_extended_err fields, but never clears addr_offset and port.
> skb_clone() copies cb[] verbatim, so the errqueue entry carries the TX
> skb's stale control block to the receive side, and the ipv4 error-queue
> reader trusts those bytes:
> 
> [...]

Here is the summary with links:
  - [net] net/sched: etf: initialise the sock_exterr_skb before filling it
    https://git.kernel.org/netdev/net/c/7076f684d513

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html