[PATCH net] ip: skip IPv4 cmsgs for non-IPv4 packets

[Daehyeon Ko <4ncienth@gmail.com>]

IPV6_ADDRFORM can convert an IPv6 UDP socket while a native IPv6 packet
is still queued for reception.  The converted socket then receives the
packet through udp_recvmsg(), which passes it to ip_cmsg_recv_offset() as
if it were IPv4.

This makes the IPv4 ancillary-data code interpret inet6_skb_parm as
inet_skb_parm.  In particular, IP_RETOPTS can take the IPv6 lastopt and
nhoff offsets as an IPv4 option length and RR offset.  A destination
options header can then make __ip_options_echo() copy more than the
40-byte stack option buffer.

KASAN reported a 152-byte write on 3/3 fresh v6.12.105 boots and 3/3
fresh v7.2 boots.  A production-shaped v6.12.105 build instead reached a
hardened-usercopy BUG followed by a fatal-exception panic on 3/3 boots.

Check the skb protocol before parsing SOL_IP control messages.  This
preserves the queued payload while omitting incompatible ancillary data,
and also protects callers processing a stale non-IPv4 error-queue skb.
With this change the trigger returned its payload without a control
message or a target KASAN report on 3/3 fresh boots; both controls passed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
 net/ipv4/ip_sockglue.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index a55ef327ec932c..24cb74c3d62025 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -22,6 +22,7 @@
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <linux/icmp.h>
+#include <linux/if_ether.h>
 #include <linux/inetdevice.h>
 #include <linux/netdevice.h>
 #include <linux/slab.h>
@@ -171,6 +172,9 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,
 {
 	unsigned long flags = inet_cmsg_flags(inet_sk(sk));
 
+	if (unlikely(skb->protocol != htons(ETH_P_IP)))
+		return;
+
 	if (!flags)
 		return;
 
-- 
2.54.0