Re: [PATCH net 1/1] ipmr: only copy pktinfo to cache reports

On Tue, Jul 28, 2026 at 12:44:49AM +0800, Ren Wei wrote:

quoted

From: Zhiling Zou <redacted>

ipmr_cache_report() builds short IGMP reports for mrouted from a packet
that may be a synthetic RTM_GETROUTE query. That query skb stores the
netlink requester portid in NETLINK_CB(), but the report is delivered to
a raw IPv4 socket, whose receive path interprets skb->cb as IPCB().

Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP
msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the
original packet and then copying the whole control buffer to the report
skb. For synthetic route-query packets, this copies NETLINK_CB bytes

It's copying 48 bytes, which is the size of the control block. Please reword.

quoted

into IPCB and lets a controlled portid corrupt IPCB(skb)->opt. With
IP_RECVOPTS or IP_RETOPTS enabled, the raw socket receive path can then
copy past the short report packet or overflow the stack option buffer.

Keep the IP_PKTINFO support, but initialize the report skb control buffer
and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare().

This can break IP_RECVOPTS and IP_RETOPTS on the mrouted socket, but
this was never meant to work (side effect of bb7403655b3c) and therefore
unlikely to cause any regressions. Please mention this in the commit
message.

quoted

Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:gpt-5.6-terra
Signed-off-by: Zhiling Zou <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/ipv4/ipmr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1d9a4ac14fcef..783de5de02ddd 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c

@@ -1061,6 +1061,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+     struct in_pktinfo *info;
      struct sock *mroute_sk;
      struct igmphdr *igmp;
      struct igmpmsg *msg;
      struct sk_buff *skb;
      int ret;

@@ -1113,7 +1114,10 @@ static int ipmr_cache_report(const struct mr_table *mrt,
              msg->im_vif = vifi;
              msg->im_vif_hi = vifi >> 8;
              ipv4_pktinfo_prepare(mroute_sk, pkt, false);
-             memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
+             info = PKTINFO_SKB_CB(skb);
+             memset(skb->cb, 0, sizeof(skb->cb));
+             info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
+             info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
              /* Add our header.
               * Note that code, csum and group fields are cleared.
               */

I believe that Sashiko is correct and there is a similar problem with
the other branch:

https://sashiko.dev/#/patchset/5bc7cd71c2d671b305f25497d88ae8a0aa663c08.1784894076.git.zhilinz%40nebusec.ai

This should fix both:

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1d9a4ac14fce..4827973c6f9c 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c

@@ -1058,6 +1058,7 @@ static int ipmr_cache_report(const struct mr_table *mrt,
                             struct sk_buff *pkt, vifi_t vifi, int assert)
 {
        const int ihl = ip_hdrlen(pkt);
+       struct in_pktinfo *info;
        struct sock *mroute_sk;
        struct igmphdr *igmp;
        struct igmpmsg *msg;

@@ -1112,8 +1113,6 @@ static int ipmr_cache_report(const struct mr_table *mrt,
                msg = (struct igmpmsg *)skb_network_header(skb);
                msg->im_vif = vifi;
                msg->im_vif_hi = vifi >> 8;
-               ipv4_pktinfo_prepare(mroute_sk, pkt, false);
-               memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
                /* Add our header.
                 * Note that code, csum and group fields are cleared.
                 */

@@ -1124,6 +1123,12 @@ static int ipmr_cache_report(const struct mr_table *mrt,
                skb->transport_header = skb->network_header;
        }

+       ipv4_pktinfo_prepare(mroute_sk, pkt, false);
+       memset(skb->cb, 0, sizeof(skb->cb));
+       info = PKTINFO_SKB_CB(skb);
+       info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex;
+       info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst;
+
        igmpmsg_netlink_event(mrt, skb);

        /* Deliver to mrouted */