From 31b564f70d8819a1c11d0fd504fe582fc0e0f0cf Mon Sep 17 00:00:00 2001 From: Theodor Arsenij Larionov Trichkine Date: Mon, 12 Oct 2026 12:10:28 +0200 Subject: [PATCH] net: use the full socket in sk_mc_loop() sk_mc_loop() is called from ip_mc_output() and ip6_finish_output2() with skb->sk, which is not always a full socket: - Since commit ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener"), a SYNACK is attached to its request socket. - Since commit 79636038d37e ("ipv4: tcp: give socket pointer to control skbs"), an ACK or RST sent by ip_send_unicast_reply() on behalf of a TIME_WAIT socket is attached to the timewait socket. When such a packet uses a multicast route, inet_test_bit(MC_LOOP, sk) reads inet_flags past the end of the request or timewait socket. This happens for instance when a SYN with a multicast source address reaches a listener, after being looped back with its dst attached, so that ip_rcv_finish_core() skips the martian source check. A raw IP_HDRINCL socket sending to a local address does this, as does re-injection by nft dup or the iptables TEE target. The destination can also come from a source route option, or from a route of type multicast covering a unicast prefix. BUG: KASAN: slab-out-of-bounds in sk_mc_loop+0x111/0x170 Read of size 8 at addr ffff88800f2b7f10 by task repro-raw/470 Call Trace: sk_mc_loop+0x111/0x170 ip_mc_output+0x355/0x930 ip_build_and_send_pkt+0xb87/0xc50 tcp_v4_send_synack+0x500/0x6f0 tcp_conn_request+0x2135/0x2d90 tcp_v4_conn_request+0xa5/0x210 tcp_rcv_state_process+0x136e/0x6920 tcp_v4_do_rcv+0x339/0xb10 tcp_v4_rcv+0x34ab/0x3ab0 ip_protocol_deliver_rcu+0x6e/0x3e0 ip_local_deliver_finish+0x34d/0x510 ip_local_deliver+0x1bc/0x310 ip_rcv+0x390/0x410 __netif_receive_skb_one_core+0x199/0x1e0 process_backlog+0x239/0x680 __napi_poll+0xb5/0x650 net_rx_action+0x980/0xd60 handle_softirqs+0x17f/0x590 do_softirq+0x3f/0x60 The buggy address belongs to the object at ffff88800f2b7d60 which belongs to the cache request_sock_TCP of size 312 The buggy address is located 120 bytes to the right of allocated 312-byte region [ffff88800f2b7d60, ffff88800f2b7e98) Use sk_const_to_full_sk(), which restores the behavior from before the two commits above: a request socket uses the setting of its listener, and a timewait socket gets the default (loop back), as the per-cpu control socket used before had. Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener") Fixes: 79636038d37e ("ipv4: tcp: give socket pointer to control skbs") Signed-off-by: Theodor Arsenij Larionov Trichkine [edumazet: rewrote the changelog, added the TIME_WAIT case] Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20261012101029.927296-2-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- net/core/sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/sock.c b/net/core/sock.c index e8551df8330f..1302c1e848b2 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -769,6 +769,7 @@ bool sk_mc_loop(const struct sock *sk) { if (dev_recursion_level()) return false; + sk = sk_const_to_full_sk(sk); if (!sk) return true; /* IPV6_ADDRFORM can change sk->sk_family under us. */