[PATCH net] net: guard timestamp cmsgs to real error queue skbs

[PATCH net] net: guard timestamp cmsgs to real error queue skbs

[Kyle Zeng]

skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.

If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.

Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.

Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 include/net/sock.h   |  1 +
 net/core/skbuff.c    |  6 +++---
 net/socket.c         | 11 ++++++-----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index dccd3738c368..95e157eee8d9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1856,6 +1856,7 @@ struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size,
 			     gfp_t priority);
 void skb_orphan_partial(struct sk_buff *skb);
 void sock_rfree(struct sk_buff *skb);
+void sock_rmem_free(struct sk_buff *skb);
 void sock_efree(struct sk_buff *skb);
 #ifdef CONFIG_INET
 void sock_edemux(struct sk_buff *skb);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c02f0a507ba8..8eab8eb5006a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5450,7 +5450,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 }
 EXPORT_SYMBOL_GPL(skb_cow_data);
 
-static void sock_rmem_free(struct sk_buff *skb)
+void sock_rmem_free(struct sk_buff *skb)
 {
 	struct sock *sk = skb->sk;
 
@@ -5459,8 +5459,8 @@ static void sock_rmem_free(struct sk_buff *skb)
 
 static void skb_set_err_queue(struct sk_buff *skb)
 {
-	/* pkt_type of skbs received on local sockets is never PACKET_OUTGOING.
-	 * So, it is safe to (mis)use it to mark skbs on the error queue.
+	/* The error-queue test in skb_is_err_queue() matches this marker
+	 * with the sock_rmem_free destructor installed by sock_queue_err_skb().
 	 */
 	skb->pkt_type = PACKET_OUTGOING;
 	BUILD_BUG_ON(PACKET_OUTGOING == 0);
diff --git a/net/socket.c b/net/socket.c
index 22a412fdec07..c2698a1441a7 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -852,12 +852,13 @@ EXPORT_SYMBOL(kernel_sendmsg);
 
 static bool skb_is_err_queue(const struct sk_buff *skb)
 {
-	/* pkt_type of skbs enqueued on the error queue are set to
-	 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
-	 * in recvmsg, since skbs received on a local socket will never
-	 * have a pkt_type of PACKET_OUTGOING.
+	/* Error-queue skbs are marked as PACKET_OUTGOING in
+	 * skb_set_err_queue() and use the destructor installed by
+	 * sock_queue_err_skb(). PACKET_OUTGOING alone is not unique:
+	 * AF_PACKET outgoing taps use the same pkt_type.
 	 */
-	return skb->pkt_type == PACKET_OUTGOING;
+	return skb->pkt_type == PACKET_OUTGOING &&
+	       skb->destructor == sock_rmem_free;
 }
 
 /* On transmit, software and hardware timestamps are returned independently.
-- 
2.43.0

Re: [PATCH net] net: guard timestamp cmsgs to real error queue skbs

[Kuniyuki Iwashima]

On Sat, Jun 6, 2026 at 7:29 PM Kyle Zeng <kylebot@openai.com> wrote:
>
> skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
> from sk_error_queue. That assumption is not true for AF_PACKET sockets:
> outgoing packet taps are also delivered to packet sockets with
> skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
> instead of struct sock_exterr_skb.
>
> If such an skb is received with timestamping enabled, the generic
> timestamp cmsg path can read AF_PACKET control-buffer state as
> sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
> counter overlaps opt_stats. An odd drop count makes the path emit
> SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
> skbs this copies past the linear head and can trigger hardened usercopy or
> disclose adjacent heap contents.
>
> Keep skb_is_err_queue() local to net/socket.c, but make it verify that
> the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
> installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
> receive ownership and no longer pass as error-queue skbs, while legitimate
> sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
> ownership.
>
> Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net] net: guard timestamp cmsgs to real error queue skbs

[Jason Xing]

On Sun, Jun 7, 2026 at 9:29 AM Kyle Zeng <kylebot@openai.com> wrote:
>
> skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
> from sk_error_queue. That assumption is not true for AF_PACKET sockets:
> outgoing packet taps are also delivered to packet sockets with
> skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
> instead of struct sock_exterr_skb.
>
> If such an skb is received with timestamping enabled, the generic
> timestamp cmsg path can read AF_PACKET control-buffer state as
> sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
> counter overlaps opt_stats. An odd drop count makes the path emit
> SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
> skbs this copies past the linear head and can trigger hardened usercopy or
> disclose adjacent heap contents.
>
> Keep skb_is_err_queue() local to net/socket.c, but make it verify that
> the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
> installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
> receive ownership and no longer pass as error-queue skbs, while legitimate
> sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
> ownership.
>
> Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Thanks for the fix.

Using sock_rmem_free() is a bit tricky here, especially in the general
path, so I think it would be better to get rid of this unreliable way
of checking.

My take on this is: since it's only caused in the AF_PACKET scenario,
how about only handling this like removing the ongoing flag in the
packet_rcv() path instead of touching the general function (which is
skb_is_err_queue())?

Thanks,
Jason

> ---
>  include/net/sock.h   |  1 +
>  net/core/skbuff.c    |  6 +++---
>  net/socket.c         | 11 ++++++-----
>  3 files changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index dccd3738c368..95e157eee8d9 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1856,6 +1856,7 @@ struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size,
>                              gfp_t priority);
>  void skb_orphan_partial(struct sk_buff *skb);
>  void sock_rfree(struct sk_buff *skb);
> +void sock_rmem_free(struct sk_buff *skb);
>  void sock_efree(struct sk_buff *skb);
>  #ifdef CONFIG_INET
>  void sock_edemux(struct sk_buff *skb);
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index c02f0a507ba8..8eab8eb5006a 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -5450,7 +5450,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
>  }
>  EXPORT_SYMBOL_GPL(skb_cow_data);
>
> -static void sock_rmem_free(struct sk_buff *skb)
> +void sock_rmem_free(struct sk_buff *skb)
>  {
>         struct sock *sk = skb->sk;
>
> @@ -5459,8 +5459,8 @@ static void sock_rmem_free(struct sk_buff *skb)
>
>  static void skb_set_err_queue(struct sk_buff *skb)
>  {
> -       /* pkt_type of skbs received on local sockets is never PACKET_OUTGOING.
> -        * So, it is safe to (mis)use it to mark skbs on the error queue.
> +       /* The error-queue test in skb_is_err_queue() matches this marker
> +        * with the sock_rmem_free destructor installed by sock_queue_err_skb().
>          */
>         skb->pkt_type = PACKET_OUTGOING;
>         BUILD_BUG_ON(PACKET_OUTGOING == 0);
> diff --git a/net/socket.c b/net/socket.c
> index 22a412fdec07..c2698a1441a7 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -852,12 +852,13 @@ EXPORT_SYMBOL(kernel_sendmsg);
>
>  static bool skb_is_err_queue(const struct sk_buff *skb)
>  {
> -       /* pkt_type of skbs enqueued on the error queue are set to
> -        * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
> -        * in recvmsg, since skbs received on a local socket will never
> -        * have a pkt_type of PACKET_OUTGOING.
> +       /* Error-queue skbs are marked as PACKET_OUTGOING in
> +        * skb_set_err_queue() and use the destructor installed by
> +        * sock_queue_err_skb(). PACKET_OUTGOING alone is not unique:
> +        * AF_PACKET outgoing taps use the same pkt_type.
>          */
> -       return skb->pkt_type == PACKET_OUTGOING;
> +       return skb->pkt_type == PACKET_OUTGOING &&
> +              skb->destructor == sock_rmem_free;
>  }
>
>  /* On transmit, software and hardware timestamps are returned independently.
> --
> 2.43.0
>

Re: [PATCH net] net: guard timestamp cmsgs to real error queue skbs

[Willem de Bruijn]

Kyle Zeng wrote:
> skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
> from sk_error_queue. That assumption is not true for AF_PACKET sockets:
> outgoing packet taps are also delivered to packet sockets with
> skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
> instead of struct sock_exterr_skb.
> 
> If such an skb is received with timestamping enabled, the generic
> timestamp cmsg path can read AF_PACKET control-buffer state as
> sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
> counter overlaps opt_stats. An odd drop count makes the path emit
> SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
> skbs this copies past the linear head and can trigger hardened usercopy or
> disclose adjacent heap contents.
> 
> Keep skb_is_err_queue() local to net/socket.c, but make it verify that
> the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
> installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
> receive ownership and no longer pass as error-queue skbs, while legitimate
> sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
> ownership.
> 
> Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>