Re: [PATCH net] net/sched: etf: initialise the sock_exterr_skb before filling it

[Simon Horman <horms@kernel.org>]

On Wed, Oct 21, 2026 at 11:54:01PM +0800, Dudu Lu wrote:
> report_sock_error() clones the transmitted skb, overlays a
> struct sock_exterr_skb on its control block and fills in the seven
> struct sock_extended_err fields, but never clears addr_offset and port.
> skb_clone() copies cb[] verbatim, so the errqueue entry carries the TX
> skb's stale control block to the receive side, and the ipv4 error-queue
> reader trusts those bytes:
> 
>   net/ipv4/ip_sockglue.c:556
> 	sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
> 					   serr->addr_offset);
> 	sin->sin_port = serr->port;
> 
> The gate that is supposed to guard that read only asks whether an
> address was requested at all:
> 
>   net/ipv4/ip_sockglue.c:484
> 	return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
> 	       serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port;
> 
> SO_EE_ORIGIN_TXTIME is neither ICMP nor LOCAL, so for sch_etf the gate is
> decided by serr->port alone -- by the stale byte pair.  When it is
> non-zero the reader dereferences skb_network_header() + addr_offset with
> an arbitrary offset.  On the TCP path cb[40..44) is not zero: the
> transmit path stored delivered_mstamp there (tcp_rate_skb_sent()), which
> is exactly where addr_offset/port sit in the arm64 struct layout.
> 
> Reached with an unmodified 7.3-rc4 (arm64, KASAN, in-tree modules): a TCP
> socket enables TX-timestamp error reporting (SO_TXTIME with
> SOF_TXTIME_REPORT_ERRORS), a sch_etf qdisc drops the packet, and a
> recvmsg() reaches ip_recv_error():
> 
>   BUG: KASAN: slab-out-of-bounds in ip_recv_error+0x970/0xa0c
>   Read of size 4 at addr ffff0000158ffdd5 by task A-227-A227-1_S2/113
>   ip_recv_error+0x970/0xa0c
>   inet_recv_error+0x94/0xdc
>   tcp_recvmsg+0x378/0x408
>   ...
>   The buggy address is located 149 bytes to the right of
>   allocated 704-byte region
> 
> Zero the whole overlay rather than the two fields individually: the
> errqueue entry is handed to the receive side as a self-contained record,
> which is what every other producer in the tree already does (sch_etf was
> the only error-queue producer that cleared neither field).  This does not
> change what the in-tree selftest observes -- so_txtime.c reads only
> ee_origin/ee_errno/ee_code/ee_data/ee_info, never msg_name or sin_port.
> 
> Fixes: 4b15c7075352 ("net/sched: Make etf report drops on error_queue")
> Assisted-by: LLM
> Signed-off-by: Dudu Lu <phx0fer@gmail.com>
> ---
> Tested base
> -----------
> Detected on Linux 7.3-rc4 (commit 93f51579e7df), arm64 QEMU guest.
> Re-checked against mainline f47d223627f8 (v7.3-341): the affected code
> is unchanged between the two, so the bug is still present there.
> Checked against linux-next next-20261021 (commit 9a482184d910): the
> affected code is unchanged there as well, so the bug is still present in
> linux-next too.
> 
> Reproducer status
> -----------------
> A reproducer was written and executed on an arm64 QEMU guest (dummy-virt,
> KASAN kernel) against unmodified 7.3-rc4 in-tree modules; KASAN fired at the
> claimed sink.  The reproducer source is not posted here per
> Documentation/process/security-bugs.rst ("do not publicly share a reproducer");
> it is available on request.
> 
> Triggering conditions
> ---------------------
> CAP_NET_ADMIN to install the etf qdisc; the socket must opt into TX
> timestamp error reporting (SO_TXTIME + SOF_TXTIME_REPORT_ERRORS); a TCP flow
> with a non-empty retransmit queue.  No out-of-tree module is needed.
> 
> Notes
> -----
> Built and checkpatch-clean: this patch was applied on top of 7.3-rc4
> (commit 93f51579e7df) and a full arm64 kernel (defconfig) was built with
> it -- no new warnings or errors.  scripts/checkpatch.pl reports 0 errors,
> 0 warnings.

Reviewed-by: Simon Horman <horms@kernel.org>