Re: [PATCH net v3] ip: validate options before echoing them

[Jiayuan Chen]

on 9/2/26 1:58 PM, Daehyeon Ko wrote:
> IPv4 option metadata stores absolute offsets from the network header in the
> skb control block. That metadata is only safe to use while it still
> describes the header at skb_network_header().
>
> This invariant can be broken in more than one way. An IPv6 UDP packet can
> remain queued while IPV6_ADDRFORM converts its socket to IPv4, after which


For IPV6_ADDRFORM, we already reject this operation if outgoing ipv6 
packets still exist.

case IPV6_ADDRFORM: ...... if (sk->sk_protocol == IPPROTO_UDP) { if 
(udp_sk(sk)->pending == AF_INET6) { retv = -EBUSY; break; }

May be we can also reject this operationif ipv6 skbs still exist in 
read/recv queue ?