Re: [PATCH net] cipso: stop modifying live ip_options_rcu

[Casey Schaufler]

On 11/6/2026 3:06 PM, Eric Dumazet wrote:
> Le ven. 6 nov. 2026 à 22:40, Jann Horn <jannh@xxxxxxxxxx> a écrit :
>> cipso_v4_delopt() operates on the ip_options_rcu of a socket or a request
>> socket, and tries to remove CIPSO options from the middle by moving all
>> subsequent options.
>> That's not allowed - ip_options_rcu can be read locklessly and must always
>> be consistent. For example, ip_options_undo() reads trusted offsets and
>> length values from the options buffer.
>> Fix it by doing the modification in a copy.
>>
>> The core change is in cipso_v4_delopt(), the rest is ugly plumbing to
>> propagate memory allocation failures.
>>
>> Triggering this bug requires that the system is configured to use CIPSO.
>> (Setting up CIPSO requires privileges in init_user_ns.)
>>
>> Fixes: f6d8bd051c39 ("inet: add RCU protection to inet->opt")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
>> ---
>> I've sent a separate mail with a reproducer to Paul Moore.
> Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
>
> Side note, not for this patch: Smack calls netlbl_sock_delattr()
> and netlbl_sock_setattr() under bh_lock_sock_nested() only, which does
> not exclude a concurrent lock_sock() owner such as
> setsockopt(IP_OPTIONS). Both sides can then kfree_rcu() the same
> old inet_opt. This already exists in the "cipso only" branch of
> cipso_v4_delopt() and in cipso_v4_sock_setattr(), and with this patch
> the copy branch has the same issue.
>
> The rcu_dereference_protected(*opt_ptr, 1) in cipso_v4_delopt() hides
> this from lockdep. Smack should probably use lock_sock() like
> SELinux does in selinux_netlbl_socket_connect().

Thank you. I will give this a try. I would be happy to accept a viable
patch from any of the numerous people who know locking better than I.

>
> Thanks !