github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: guard timestamp cmsgs to real error queue skbs

Browse Source 
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.

If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.

Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.

Fixes: 8605330aac ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Kyle Zeng 2026-06-06 19:18:19 -07:00 committed by Jakub Kicinski
parent 6f4c80a2a7
commit 1ee90b77b7
3 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/sock.h
View File

@ -1856,6 +1856,7 @@ struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size,
gfp_t priority); gfp_t priority);
void skb_orphan_partial(struct sk_buff *skb); void skb_orphan_partial(struct sk_buff *skb);
void sock_rfree(struct sk_buff *skb); void sock_rfree(struct sk_buff *skb);
void sock_rmem_free(struct sk_buff *skb);
void sock_efree(struct sk_buff *skb); void sock_efree(struct sk_buff *skb);
#ifdef CONFIG_INET #ifdef CONFIG_INET
void sock_edemux(struct sk_buff *skb); void sock_edemux(struct sk_buff *skb);

6
net/core/skbuff.c
View File

@ -5450,7 +5450,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
} }
EXPORT_SYMBOL_GPL(skb_cow_data); EXPORT_SYMBOL_GPL(skb_cow_data);
static void sock_rmem_free(struct sk_buff *skb) void sock_rmem_free(struct sk_buff *skb)
{ {
struct sock *sk = skb->sk; struct sock *sk = skb->sk;
@ -5459,8 +5459,8 @@ static void sock_rmem_free(struct sk_buff *skb)
static void skb_set_err_queue(struct sk_buff *skb) static void skb_set_err_queue(struct sk_buff *skb)
{ {
/* pkt_type of skbs received on local sockets is never PACKET_OUTGOING. /* The error-queue test in skb_is_err_queue() matches this marker
* So, it is safe to (mis)use it to mark skbs on the error queue. * with the sock_rmem_free destructor installed by sock_queue_err_skb().
*/ */
skb->pkt_type = PACKET_OUTGOING; skb->pkt_type = PACKET_OUTGOING;
BUILD_BUG_ON(PACKET_OUTGOING == 0); BUILD_BUG_ON(PACKET_OUTGOING == 0);

11
net/socket.c
View File

@ -852,12 +852,13 @@ EXPORT_SYMBOL(kernel_sendmsg);
static bool skb_is_err_queue(const struct sk_buff *skb) static bool skb_is_err_queue(const struct sk_buff *skb)
{ {
/* pkt_type of skbs enqueued on the error queue are set to /* Error-queue skbs are marked as PACKET_OUTGOING in
* PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do * skb_set_err_queue() and use the destructor installed by
* in recvmsg, since skbs received on a local socket will never * sock_queue_err_skb(). PACKET_OUTGOING alone is not unique:
* have a pkt_type of PACKET_OUTGOING. * AF_PACKET outgoing taps use the same pkt_type.
*/ */
return skb->pkt_type == PACKET_OUTGOING; return skb->pkt_type == PACKET_OUTGOING &&
skb->destructor == sock_rmem_free;
} }
/* On transmit, software and hardware timestamps are returned independently. /* On transmit, software and hardware timestamps are returned independently.