[PATCH net 1/1] ipmr: only copy pktinfo to cache reports

From: Zhiling Zou <redacted>

ipmr_cache_report() builds short IGMP reports for mrouted from a packet
that may be a synthetic RTM_GETROUTE query. That query skb stores the
netlink requester portid in NETLINK_CB(), but the report is delivered to
a raw IPv4 socket, whose receive path interprets skb->cb as IPCB().

Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP
msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the
original packet and then copying the whole control buffer to the report
skb. For synthetic route-query packets, this copies NETLINK_CB bytes
into IPCB and lets a controlled portid corrupt IPCB(skb)->opt. With
IP_RECVOPTS or IP_RETOPTS enabled, the raw socket receive path can then
copy past the short report packet or overflow the stack option buffer.

Keep the IP_PKTINFO support, but initialize the report skb control buffer
and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare().

Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:gpt-5.6-terra
Signed-off-by: Zhiling Zou <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/ipv4/ipmr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1d9a4ac14fcef..783de5de02ddd 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c

@@ -1061,6 +1061,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+	struct in_pktinfo *info;
 	struct sock *mroute_sk;
 	struct igmphdr *igmp;
 	struct igmpmsg *msg;
 	struct sk_buff *skb;
 	int ret;
 

@@ -1113,7 +1114,10 @@ static int ipmr_cache_report(const struct mr_table *mrt,
 		msg->im_vif = vifi;
 		msg->im_vif_hi = vifi >> 8;
 		ipv4_pktinfo_prepare(mroute_sk, pkt, false);
-		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
+		info = PKTINFO_SKB_CB(skb);
+		memset(skb->cb, 0, sizeof(skb->cb));
+		info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
+		info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
 		/* Add our header.
 		 * Note that code, csum and group fields are cleared.
 		 */

-- 
2.43.0