Re: [PATCH net 1/1] net: Don't deliver IPv6 packets to IPv4 sockets

[Eric Dumazet]

On Sun, Aug 23, 2026 at 12:18 PM Shihuang Liu <shlomojune6@xxxxxxxxx> wrote:
>
> bpf_sk_assign() allows a TC ingress program to attach an arbitrary
> hashed socket to an skb, without checking that the socket family
> matches the packet's network layer. As a result, an IPv6 UDP packet
> can be assigned to an AF_INET UDP socket: udpv6_rcv() steals the
> socket via inet6_steal_sock(), which also lacks a family check, and
> queues the IPv6 skb on the AF_INET socket.
>
> recvmsg() on that socket then runs the IPv4 udp_recvmsg(), which
> interprets the IPv6 skb control block as IPv4 IP options. When
> IP_RETOPTS is enabled on the target socket, __ip_options_echo()
> copies up to 153 bytes of attacker-controlled data from the IPv6
> Destination Options extension header into the 40-byte option-data
> area of the stack-allocated optbuf in ip_cmsg_recv_retopts():
>
>

Really you need to ask your LLM to not slow down linux fast paths.

Fix bpf_sk_assign() and bpf_sk_assign_tcp_reqsk() instead.

Thank you.

pw-bot: cr