Re: [PATCH net v3] ip: validate options before echoing them

[Ido Schimmel]

On Wed, Sep 02, 2026 at 10:44:45AM +0200, Eric Dumazet wrote:
> Oh well. Ai reviews will probably raise many bugs in this patch :/
> 
> ipmr_cache_report() is a distinct bug and needs its own one liner fix.
> 
> When ipmr_cache_report() builds an IGMPMSG_WHOLEPKT or IGMPMSG_WRVIFWHOLE
> report, it reallocates headroom and pushes a 20-byte iphdr with ihl = 5, but
> inherits pkt->cb with stale IPCB(skb)->opt offsets.
> Even if __ip_options_echo() rejects it, ip_cmsg_recv_opts() will still read
> stale IPCB(skb)->opt.optlen bytes from ip_hdr(skb) + 1 and leak packet data
> as IP_RECVOPTS.
> ipmr_cache_report() must clear IPCB(skb)->opt (or memset IPCB(skb)) when
> prepending the report header.
> 
> Something like:
> 
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index e5f2b1c6150d2f6b2084c2ebaef6047db869cc87..72f1d620b8760722f805935d0299bac24a9f720c
> 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -1102,6 +1102,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
>                 ip_hdr(skb)->ihl = sizeof(struct iphdr) >> 2;
>                 ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(pkt)->tot_len) +
>                                              sizeof(struct iphdr));
> +               memset(&IPCB(skb)->opt, 0, sizeof(IPCB(skb)->opt));
>         } else {
>                 /* Copy the IP header */
>                 skb_set_network_header(skb, skb->len);

Yes, this was raised in the past [1].

Zhiling Zou, please send v4 of [2].

[1] https://lore.kernel.org/netdev/20260805081737.GA1284302@shredder/
[2] https://lore.kernel.org/netdev/e93d0d2fa5725ddd06b20e3e4223ab68b93b48d1.1785719031.git.zhilinz@xxxxxxxxxx/