From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590164; b=ybLHy6hwpqseVOersFEw+Fzg5/nlJPY1SyIkABSCjLq0cugLwmdNPEK4zXH3nPjnlyvF 8LpRdVifMZ9AQaFQXNW/bfEn0Rc4+tvJohpLs9xHvWFZK7Bzsk2CZaw1SHCWtn0Yho7F9 KxkcV6Oc6cWdHxJvPOYfNc/clk/SQCpLrZ9MBYr//FehMHYKyAnIpNx00Pd+zXLyFw5ZZ yBttwY6QTgQohD6cPaYVi+m0G4i7pRtNLB9odLRHBLvPmCusTCK0fN3v0VABr0bRznfB1 AhMuI9pMkAgjGKmfVwn/xbCDuApmmGErezQf6wVI82LEbdwkbFr5F8eAzogSWPIM6Xw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590164; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=T5JYrXe7Ap4JVdwhq+q8fjLTgk/x87UHGxdfDVftF2g=; b=wBlD8fzSjLFEUZG2bcnBEwm9zdMIFtmvlNc4ZAMxsB//MatgRZ263LQGBOF/eXdjuVlm 0aadoMz4cTfYw15aT07I61q0K235Do0EYYSHy3aLF8EacCvjyQEh2dZi/rGchsEogQRmR O3rGZl/hRtkYldDR4QpTgPtJG6U5SomqX1UxzUgrZi6owNf1OlYe4eeqS3zi8EAlv4IFR mS1pLTgR4Q2Ug1eGIUtu3cpBIR2uT5mK93G4OzHQ1anPeWkig0N7WW4yaTr4ZNWRKIqZ+ /ZiANcYY5Uwi481YYQJq0tI2w6r/5Mtv5KGeIhYwfQdR3Y8O/WDAWLk3Uvwrpg3Velg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Y4291wGx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB8AB606E213; Fri, 13 Nov 2026 17:16:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Y4291wGx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C9C41F000C4; Fri, 13 Nov 2026 17:16:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590163; bh=T5JYrXe7Ap4JVdwhq+q8fjLTgk/x87UHGxdfDVftF2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Y4291wGxjJYx0rEI9ApQZ29HeZuSjmA2Seng2rXcFDKsJ/OaOW6i36roC/XrN0/1c 9P+XZHQ31FKp0ld8WMnxPJuXu5JnPiaQVoWHur1a4DzKdMjvya7H3aCy7tXL8hnVYC 2SxwfHo+X1DsptvlyP74Yx3CFEM5G3RiveIa0xRI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sashiko , Ido Schimmel , Hangbin Liu , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.18 175/686] ipmr, ip6mr: validate packets injected into the register vif on xmit Date: Fri, 13 Nov 2026 10:45:08 -0500 Message-ID: <20261113153826.934799662@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ido Schimmel [ Upstream commit aa1799e93f5ebb973252aec649d84d12d9c7fd1c ] reg_vif_xmit() passes the packet to ipmr_cache_report() which copies its IP header into the IGMPMSG_WHOLEPKT report that is queued to the mroute socket. Nothing guarantees that the packet contains a full IP header, so when a short packet is injected on the register device (e.g., using AF_PACKET), the copy reads past the end of the packet and a recvmsg() on the mroute socket leaks the uninitialized bytes to user space [1]. IPv6 has the same problem [2]. Its reg_vif_xmit() does call pskb_inet_may_pull(), but the helper keys off skb->protocol and does not pull anything when the protocol is neither IPv4 nor IPv6. Fix by dropping packets whose protocol does not match the address family of the register device or that do not contain a full network header. [1] BUG: KMSAN: kernel-infoleak in _copy_to_iter raw_recvmsg Uninit was stored to memory at: ipmr_cache_report reg_vif_xmit packet_sendmsg Uninit was created at: __alloc_skb sock_alloc_send_pskb packet_sendmsg Bytes 1-3 of 21 are uninitialized [2] BUG: KMSAN: kernel-infoleak in _copy_to_iter rawv6_recvmsg Uninit was stored to memory at: ip6mr_cache_report reg_vif_xmit packet_sendmsg Uninit was created at: __alloc_skb sock_alloc_send_pskb packet_sendmsg Bytes 8-23 of 41 are uninitialized Fixes: 14fb64e1f449 ("[IPV6] MROUTE: Support PIM-SM (SSM).") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/0545f0c83f5ee2f6696210f87268e811ef655715.1792476357.git.zhilinz%40nebusec.ai Signed-off-by: Ido Schimmel Reviewed-by: Hangbin Liu Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20261025071729.34967-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv4/ipmr.c | 6 ++++++ net/ipv6/ip6mr.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 66a7f25f236b8..f3464e7a337b6 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -530,6 +530,12 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev) }; int err; + if (skb->protocol != htons(ETH_P_IP) || !pskb_inet_may_pull(skb)) { + DEV_STATS_INC(dev, tx_errors); + kfree_skb(skb); + return NETDEV_TX_OK; + } + rcu_read_lock(); err = ipmr_fib_lookup(net, &fl4, &mrt); if (err < 0) { diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c index 7b60e4b2a8179..9a2c23de98ad7 100644 --- a/net/ipv6/ip6mr.c +++ b/net/ipv6/ip6mr.c @@ -620,7 +620,7 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, .flowi6_mark = skb->mark, }; - if (!pskb_inet_may_pull(skb)) + if (skb->protocol != htons(ETH_P_IPV6) || !pskb_inet_may_pull(skb)) goto tx_err; if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) -- 2.53.0