[PATCH net 0/2] ipmr, ip6mr: Fix several info leaks

[Ido Schimmel <idosch@nvidia.com>]

ip{,6}mr_cache_report() copy the IP header of a packet that triggered an
upcall to a report packet that is delivered to user space. The header
is not always fully initialized or present, resulting in info leaks
flagged by KMSAN.

Patch 1 fixes an info leak in the RTM_GETROUTE path, caused by the fact
that ipmr_get_route() does not fully initialize the IP header of the
packet that it creates. IPv6 does not suffer from this problem.

Patch 2 fixes info leaks triggered by packets injected into pim{,6}reg
devices via AF_PACKET sockets. The kernel does not validate that these
are IP packets that carry an IP header before calling
ip{,6}mr_cache_report().

Both issues were reported by Sashiko and reproduced by me. See KMSAN
traces in the commit messages.

As far as I can tell, all other callers call these functions from the IP
input / output paths and therefore provide a valid IP packet, with the
exception of ip6mr_get_route() which fully initializes the header of the
packet it creates.

Ido Schimmel (2):
  ipmr: fully initialize the synthetic IP header in ipmr_get_route()
  ipmr, ip6mr: validate packets injected into the register vif on xmit

 net/ipv4/ipmr.c  | 7 +++++++
 net/ipv6/ip6mr.c | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

-- 
2.56.0