Re: [PATCH net-next] ip6mr: clear skb->cb[] in reg_vif_xmit()

[Ido Schimmel <idosch@nvidia.com>]

On Sat, Oct 17, 2026 at 12:42:28PM +0200, Eric Dumazet wrote:
> reg_vif_xmit() hands the skb to ip6mr_cache_report() as an
> MRT6MSG_WHOLEPKT report. skb_realloc_headroom() copies skb->cb[]
> into the report, which is queued to the mroute socket, where
> rawv6_recvmsg() reads it as IP6CB.
> 
> By the time the pim6reg device transmits the packet, skb->cb[] is
> not IP6CB anymore: qdisc_pkt_len_init() overwrites iif and ra,
> and any qdisc installed on the device (fq, fq_codel, pie, cake...)
> or a tc BPF program writing skb->cb[] fills the area holding
> dst0, srcrt, dst1, lastopt and flags.
> 
> Since commit dd433671fef3 ("ipv6: validate extension header length
> before copying to cmsg") these stale offsets can no longer cause
> out-of-bounds reads, but the mroute socket can still receive bogus
> IPV6_PKTINFO ifindex and extension header ancillary data.
> 
> Clear IP6CB before building the report. The skb is freed right
> after, so nothing else depends on its control block.
> 
> Fixes: 14fb64e1f449 ("[IPV6] MROUTE: Support PIM-SM (SSM).")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>