From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591399; b=O1yKa9yKkvm9b/eVlPDGLdA8cjzhIzIGizNYOI4Kr2o0dHu9pnCa5D6DFA+Ru047SOt5 OhLiR7uzdsOzxS/84iCpvHKTZgyLwAceIkET+lDxJu8f2d3QXGdYtyQae81+c9VlyAu22 ejU5+5zjsd1k1pUXCTOIntKLVO4L+WjGLCQUhSzqELy5zxqL9UWmsvGQmD5fSX+oK3+Wm OolZW2FTSd3bxAv3KdNPt0bKLpqfhsCRl5N11yvFP4M7WDhfA2kEcD0oPBLyQ6xwRShvv ZzKBTyzA9XFgNpoCWCDqRQZxSP0sZgP/lyJ7HsXH67E6rl5t4kPFyvFhPHwI1wPZAeQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591399; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=cjWEHlVxmBpaLhGrPOJ2i1o7+sD67Wf8PI1hfEenloI=; b=3nUbko3H8NqkJibfX6w2cCRifHdrYSKdBxLJKAf5Mav0QEZJThaTv+/AN/GFkRwwntEh gz85QRLHXfgCuHsaJbc4JkX/VaThyzqND9XjgZNgQ3nZPK1awcCJJu/fmndhHsgI9hJgi XYhyRBjIchqt3sJarVq8NSD2BJk3njR9Q+J9mIFaPspETvR3QYd78Vgd93z7mQiWhLU11 Dc5x57aX0FHS2evtkeH/xpOWTGOvId6qbb7FPL8nQjCUi3IUlsCGAOj2t2P+v+7eZ38Za MVnyJZsTO0x15vwqBdX+rSb1/yDrP7tDIkhIa8pNaSjYPbPoEZkb7cWsMDQntT06phg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=G2lLwR9B; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B91E6079D44; Fri, 13 Nov 2026 17:36:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=G2lLwR9B Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE2FB1F000C5; Fri, 13 Nov 2026 17:36:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591399; bh=cjWEHlVxmBpaLhGrPOJ2i1o7+sD67Wf8PI1hfEenloI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=G2lLwR9BjyH797fx/XpSE60zHPVfsB+yFLnPPLST8bORYi+S4b6NjnP9SI3j/aziT kxxiUvlFrDwijeA4dqy8CHT89Jproeq/n/vEDOspNmrjsudexcnz7Gqo2HQ9ET09qp YAwBUkvbqdDLCr3HFCNLgzKR6l+UczCZfNFhCTrk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Vega , Ido Schimmel , Eric Dumazet , Zhiling Zou , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.12 497/670] ipmr: only copy pktinfo to cache reports Date: Fri, 13 Nov 2026 10:51:01 -0500 Message-ID: <20261113153828.773343411@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zhiling Zou [ Upstream commit 94a6736bb5abe6b2ef38490d0cab19c1c6a7c71f ] ipmr_cache_report() prepares IP_PKTINFO on the original skb. The ipv4_pktinfo_prepare() helper updates skb->cb and clears the pktinfo fields when packet info is disabled. Since the skb can continue through the data path, preserve and restore its original control block around the helper. The original implementation copies the entire control block to the report skb. For synthetic RTM_GETROUTE packets, NETLINK_CB data is interpreted as IPCB by the raw IPv4 receive path. With IP_RECVOPTS or IP_RETOPTS enabled, corrupted option offsets cause out-of-bounds reads or a stack buffer overflow. WHOLEPKT and WRVIFWHOLE reports also inherit stale IP option offsets when their header is prepended. Clear the report skb control block. Only prepare and copy pktinfo when the input skb has an IPv4 header. Synthetic route-query skbs use NETLINK_CB, not IPCB, so leave their report control block zeroed. Restore pkt->cb after preparing pktinfo for regular IPv4 packets. Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Vega Link: https://lore.kernel.org/netdev/20260903113055.GA90787@shredder/ Suggested-by: Ido Schimmel Suggested-by: Eric Dumazet Signed-off-by: Zhiling Zou Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/0545f0c83f5ee2f6696210f87268e811ef655715.1792476357.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv4/ipmr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index b9b0be1b02a62..f9cec6b2bc1a3 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1038,6 +1038,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt, static int ipmr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, vifi_t vifi, int assert) { + unsigned char pkt_cb[sizeof(pkt->cb)]; const int ihl = ip_hdrlen(pkt); struct sock *mroute_sk; struct igmphdr *igmp; @@ -1093,8 +1094,6 @@ static int ipmr_cache_report(const struct mr_table *mrt, msg = (struct igmpmsg *)skb_network_header(skb); msg->im_vif = vifi; msg->im_vif_hi = vifi >> 8; - ipv4_pktinfo_prepare(mroute_sk, pkt, false); - memcpy(skb->cb, pkt->cb, sizeof(skb->cb)); /* Add our header. * Note that code, csum and group fields are cleared. */ @@ -1105,6 +1104,15 @@ static int ipmr_cache_report(const struct mr_table *mrt, skb->transport_header = skb->network_header; } + memset(skb->cb, 0, sizeof(skb->cb)); + /* Route queries from ipmr_get_route() carry NETLINK_CB, not IPCB. */ + if (ip_hdr(pkt)->version) { + memcpy(pkt_cb, pkt->cb, sizeof(pkt_cb)); + ipv4_pktinfo_prepare(mroute_sk, pkt, false); + *PKTINFO_SKB_CB(skb) = *PKTINFO_SKB_CB(pkt); + memcpy(pkt->cb, pkt_cb, sizeof(pkt_cb)); + } + igmpmsg_netlink_event(mrt, skb); /* Deliver to mrouted */ -- 2.53.0