Re: [PATCH net] net: require a full socket in sock_confirm_neigh()

[Kuniyuki Iwashima <kuniyu@google.com>]

On Wed, 04 Nov 2026 14:29:00 +0100, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> An skb can retain dst_pending_confirm after its original output and
> socket owner have changed. For example, a raw MSG_CONFIRM packet can
> cross veth, have a TCP request socket assigned by TPROXY, and be bridged
> into gretap. Neighbor output for the outer packet then calls
> sock_confirm_neigh() with the request socket in skb->sk.
> 
> The helper unconditionally treats a non-NULL skb->sk as a full socket
> when accessing sk_dst_pending_confirm. TCP request and TIME_WAIT sockets
> do not contain that field. This produces an out-of-bounds four-byte read
> and, if the word is nonzero, an out-of-bounds four-byte zero write. A
> KASAN-enabled kernel reports:
> 
>   BUG: KASAN: slab-out-of-bounds in ip_finish_output2+0xc9f/0xd60
>   Read of size 4 at addr ffff8880bdc3d880 by task tproxy_dst_conf/1771
> 
> Require sk_fullsock() before accessing the socket field, moving the
> existing helper earlier in the header to make it available here. Keep
> neigh_confirm() independent of the socket type so the skb's neighbor
> confirmation still works, including for socketless packets. This also
> covers the IPv6, VRF, and BPF neighbor-output callers.
> 
> Fixes: 4ff0620354f2 ("net: add dst_pending_confirm flag to skbuff")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>