[PATCH net] net: use the full socket in sk_mc_loop()

[Theodor Arsenij Larionov Trichkine]

tcp_make_synack() sets skb->sk of a SYN-ACK to the request socket.
If the SYN-ACK destination is multicast, ip_mc_output() calls
sk_mc_loop() on it, and inet_test_bit(MC_LOOP, sk) reads inet_flags,
which is past the end of the smaller request_sock object.

KASAN reports a slab-out-of-bounds (or slab-use-after-free) read in
sk_mc_loop() from tcp_v4_send_synack() when a SYN with a multicast
source address reaches a listener.

Map the socket to the full socket before reading its flags.

Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Theodor Arsenij Larionov Trichkine <theodorlarionov@xxxxxxxxx>
---
 net/core/sock.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/sock.c b/net/core/sock.c
index e8551df8330f..1302c1e848b2 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -769,6 +769,7 @@ bool sk_mc_loop(const struct sock *sk)
 {
 	if (dev_recursion_level())
 		return false;
+	sk = sk_const_to_full_sk(sk);
 	if (!sk)
 		return true;
 	/* IPV6_ADDRFORM can change sk->sk_family under us. */

base-commit: 6d25ffca055a77787c21a36b66c253f76239411b
-- 
2.34.1