[PATCH v3 net 0/2] net: fix sk_mc_loop() with request and timewait sockets

[Eric Dumazet <edumazet@kernel.org>]

Patch 1 fixes an out-of-bounds read in sk_mc_loop() when skb->sk is
a request or a timewait socket, by using the full socket.

Patch 2 fixes the route lookup of cookie_v4_check() when the ACK
carries a source route option, found while looking at the above.

Refusing to send TCP packets to broadcast or multicast destinations
is left for net-next.

v3:
- Back to the v1 approach for the sk_mc_loop() fix: checking the
  destination in TCP (v2) does not cover source routes, multicast
  typed routes on unicast prefixes, or the TIME_WAIT reply path.
- Add the TIME_WAIT case and its Fixes tag.
- Add patch 2.
v2: https://lore.kernel.org/netdev/20261008114942.1376889-1-theodorlarionov@gmail.com/
v1: https://lore.kernel.org/netdev/20261008100423.1256884-1-theodorlarionov@gmail.com/

Eric Dumazet (1):
  tcp: use the echoed source route in cookie_v4_check()

Theodor Arsenij Larionov Trichkine (1):
  net: use the full socket in sk_mc_loop()

 net/core/sock.c       |  1 +
 net/ipv4/syncookies.c | 12 ++++++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

-- 
2.53.0