Re: [PATCH net] ipv4: icmp: reject broadcast/multicast routes

[David Ahern <dsahern@kernel.org>]

On 5/19/26 2:08 PM, Eric Dumazet wrote:
> syzbot was able to trigger ip_rt_bug() in a loop, using an IPv4 packet
> with a crafted IPOPT_SSRR option:
> 
>   options: ipv4_options {
>     options: array[ipv4_option] {
>       union ipv4_option {
>         ssrr: ipv4_option_route[IPOPT_SSRR] {
>          type: const = 0x89 (1 bytes)
>          length: len = 0x7 (1 bytes)
>          pointer: int8 = 0xa2 (1 bytes)
>          data: array[ipv4_addr] {
>            union ipv4_addr {
>              broadcast: const = 0xffffffff (4 bytes)
>            }
>          }
>        }
>      }
> 
> Change __icmp_send() to not send ICMP to broadcast/multicast destinations.
> 
> Fixes: c378a9c019cf ("ipv4: Give backtrace in ip_rt_bug().")
> Reported-by: syzbot+c13a57c2639c2c0d03a6@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a0cc169.170a0220.1f6c2d.0004.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv4/icmp.c | 3 +++
>  1 file changed, 3 insertions(+)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>