[PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[Eric Dumazet]

reg_vif_xmit() hands the skb to ipmr_cache_report() as an
IGMPMSG_WHOLEPKT report. When the mroute socket has IP_PKTINFO
enabled, ipmr_cache_report() calls ipv4_pktinfo_prepare() on the
original skb, which reads skb->cb[] as IPCB.

By the time the pimreg device transmits the packet, skb->cb[] is not
IPCB anymore: qdisc_pkt_len_init() overwrites IPCB(skb)->iif with
qdisc_skb_cb(skb)->pkt_len, and any qdisc installed on the device or a
tc BPF program writing skb->cb[] fills the area holding the IP options
and IPCB(skb)->flags.

For locally generated packets routed out pimreg (they carry an rtable
dst), the mroute socket can therefore receive a bogus ipi_ifindex
(the packet length), and the l3mdev slave test in
ipv4_pktinfo_prepare() is driven by stale qdisc data.

Clear IPCB before building the report, as done for IPv6 in
commit 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").
The skb is freed right after, so nothing else depends on its control
block.

Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
Issue has been discovered while reviewing Ido's series:
 https://lore.kernel.org/netdev/CAL4WiiovWOOQ9PBPbnPk2=rK+V5WgMpOFh814-D6_A-k5ope_A@mail.gmail.com/
No repro, but this is mirroring the fix we did in 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").

 net/ipv4/ipmr.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index acacaae05cc49dc15910f23f7539865432518587..8b84142fd7754d95aa1f2facf68ac554916efd27 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -550,6 +550,11 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 	DEV_STATS_ADD(dev, tx_bytes, skb->len);
 	DEV_STATS_INC(dev, tx_packets);
 
+	/* skb->cb[] holds qdisc/tc state at this point, not IPCB.
+	 * ipmr_cache_report() reads it as IPCB to build IP_PKTINFO.
+	 */
+	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+
 	/* Pairs with WRITE_ONCE() in vif_add() and vif_delete() */
 	ipmr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num),
 			  IGMPMSG_WHOLEPKT);
-- 
2.53.0

Re: [PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[Ido Schimmel]

On Sun, Oct 25, 2026 at 12:13:37PM +0100, Eric Dumazet wrote:
> reg_vif_xmit() hands the skb to ipmr_cache_report() as an
> IGMPMSG_WHOLEPKT report. When the mroute socket has IP_PKTINFO
> enabled, ipmr_cache_report() calls ipv4_pktinfo_prepare() on the
> original skb, which reads skb->cb[] as IPCB.
> 
> By the time the pimreg device transmits the packet, skb->cb[] is not
> IPCB anymore: qdisc_pkt_len_init() overwrites IPCB(skb)->iif with
> qdisc_skb_cb(skb)->pkt_len, and any qdisc installed on the device or a
> tc BPF program writing skb->cb[] fills the area holding the IP options
> and IPCB(skb)->flags.
> 
> For locally generated packets routed out pimreg (they carry an rtable
> dst), the mroute socket can therefore receive a bogus ipi_ifindex
> (the packet length), and the l3mdev slave test in
> ipv4_pktinfo_prepare() is driven by stale qdisc data.
> 
> Clear IPCB before building the report, as done for IPv6 in
> commit 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").
> The skb is freed right after, so nothing else depends on its control
> block.
> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[Hangbin Liu]

On Sun, Oct 25, 2026 at 12:13:37PM +0100, Eric Dumazet wrote:
> reg_vif_xmit() hands the skb to ipmr_cache_report() as an
> IGMPMSG_WHOLEPKT report. When the mroute socket has IP_PKTINFO
> enabled, ipmr_cache_report() calls ipv4_pktinfo_prepare() on the
> original skb, which reads skb->cb[] as IPCB.
> 
> By the time the pimreg device transmits the packet, skb->cb[] is not
> IPCB anymore: qdisc_pkt_len_init() overwrites IPCB(skb)->iif with
> qdisc_skb_cb(skb)->pkt_len, and any qdisc installed on the device or a
> tc BPF program writing skb->cb[] fills the area holding the IP options
> and IPCB(skb)->flags.
> 
> For locally generated packets routed out pimreg (they carry an rtable
> dst), the mroute socket can therefore receive a bogus ipi_ifindex
> (the packet length), and the l3mdev slave test in
> ipv4_pktinfo_prepare() is driven by stale qdisc data.
> 
> Clear IPCB before building the report, as done for IPv6 in
> commit 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").
> The skb is freed right after, so nothing else depends on its control
> block.
> 
> Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> ---
> Issue has been discovered while reviewing Ido's series:
>  https://lore.kernel.org/netdev/CAL4WiiovWOOQ9PBPbnPk2=rK+V5WgMpOFh814-D6_A-k5ope_A@mail.gmail.com/
> No repro, but this is mirroring the fix we did in 238164201431 ("ip6mr: clear skb->cb[] in reg_vif_xmit()").
> 
>  net/ipv4/ipmr.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index acacaae05cc49dc15910f23f7539865432518587..8b84142fd7754d95aa1f2facf68ac554916efd27 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -550,6 +550,11 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
>  	DEV_STATS_ADD(dev, tx_bytes, skb->len);
>  	DEV_STATS_INC(dev, tx_packets);
>  
> +	/* skb->cb[] holds qdisc/tc state at this point, not IPCB.
> +	 * ipmr_cache_report() reads it as IPCB to build IP_PKTINFO.
> +	 */
> +	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
> +
>  	/* Pairs with WRITE_ONCE() in vif_add() and vif_delete() */
>  	ipmr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num),
>  			  IGMPMSG_WHOLEPKT);
> -- 
> 2.53.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net] ipmr: clear skb->cb[] in reg_vif_xmit()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun, 25 Oct 2026 12:13:37 +0100 you wrote:
> reg_vif_xmit() hands the skb to ipmr_cache_report() as an
> IGMPMSG_WHOLEPKT report. When the mroute socket has IP_PKTINFO
> enabled, ipmr_cache_report() calls ipv4_pktinfo_prepare() on the
> original skb, which reads skb->cb[] as IPCB.
> 
> By the time the pimreg device transmits the packet, skb->cb[] is not
> IPCB anymore: qdisc_pkt_len_init() overwrites IPCB(skb)->iif with
> qdisc_skb_cb(skb)->pkt_len, and any qdisc installed on the device or a
> tc BPF program writing skb->cb[] fills the area holding the IP options
> and IPCB(skb)->flags.
> 
> [...]

Here is the summary with links:
  - [net] ipmr: clear skb->cb[] in reg_vif_xmit()
    https://git.kernel.org/netdev/net/c/389952e8776a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html