Re: [PATCH net v6 1/1] ipmr: only copy pktinfo to cache reports

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Oct 20, 2026 at 02:39:36PM +0800, Zhiling Zou wrote:
> ipmr_cache_report() prepares IP_PKTINFO on the original skb. The
> ipv4_pktinfo_prepare() helper updates skb->cb and clears the pktinfo fields
> when packet info is disabled. Since the skb can continue through the data
> path, preserve and restore its original control block around the helper.
> 
> The original implementation copies the entire control block to the report
> skb. For synthetic RTM_GETROUTE packets, NETLINK_CB data is interpreted as
> IPCB by the raw IPv4 receive path. With IP_RECVOPTS or IP_RETOPTS enabled,
> corrupted option offsets cause out-of-bounds reads or a stack buffer
> overflow. WHOLEPKT and WRVIFWHOLE reports also inherit stale IP option
> offsets when their header is prepended.
> 
> Clear the report skb control block. Only prepare and copy pktinfo when the
> input skb has an IPv4 header. Synthetic route-query skbs use NETLINK_CB,
> not IPCB, so leave their report control block zeroed. Restore pkt->cb after
> preparing pktinfo for regular IPv4 packets.
> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Link: https://lore.kernel.org/netdev/20260903113055.GA90787@shredder/
> Suggested-by: Ido Schimmel <idosch@nvidia.com>
> Suggested-by: Eric Dumazet <edumazet@google.com>
> Assisted-by: LLM
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

There are a few pre-existing issues that the AI review flagged. I will
take care of them.