Re: [PATCH net] cipso: stop modifying live ip_options_rcu

[Casey Schaufler]

On 11/9/2026 12:13 PM, Paul Moore wrote:
> On Fri, Nov 6, 2026 at 4:40 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
>> cipso_v4_delopt() operates on the ip_options_rcu of a socket or a request
>> socket, and tries to remove CIPSO options from the middle by moving all
>> subsequent options.
>> That's not allowed - ip_options_rcu can be read locklessly and must always
>> be consistent. For example, ip_options_undo() reads trusted offsets and
>> length values from the options buffer.
>> Fix it by doing the modification in a copy.
>>
>> The core change is in cipso_v4_delopt(), the rest is ugly plumbing to
>> propagate memory allocation failures.
>>
>> Triggering this bug requires that the system is configured to use CIPSO.
>> (Setting up CIPSO requires privileges in init_user_ns.)
>>
>> Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
>> ---
>> I've sent a separate mail with a reproducer to Paul Moore.
>> ---
>>  include/net/cipso_ipv4.h     | 11 ++++++-----
>>  include/net/netlabel.h       | 11 ++++++-----
>>  net/ipv4/cipso_ipv4.c        | 16 +++++++++++++---
>>  net/netlabel/netlabel_kapi.c | 24 ++++++++++--------------
>>  security/selinux/netlabel.c  |  5 +++--
>>  security/smack/smack_lsm.c   | 14 +++++++++-----
>>  6 files changed, 47 insertions(+), 34 deletions(-)
> Thanks Jann, this looks good to me.  In a perfect world it would be
> nice to get Casey's ACK on the Smack changes, but since they are very
> minor and basically just pass the return code through I think it's
> okay to merge this in another day or so if we don't hear from him.

I don't see any reason to wait for my testing to complete. I'll shout
if anything fails.


>
> Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx>
>