Re: [PATCH net 1/1] net: Don't deliver IPv6 packets to IPv4 sockets

On Sun, Aug 23, 2026 at 12:18 PM Shihuang Liu [off-list ref] wrote:

bpf_sk_assign() allows a TC ingress program to attach an arbitrary
hashed socket to an skb, without checking that the socket family
matches the packet's network layer. As a result, an IPv6 UDP packet
can be assigned to an AF_INET UDP socket: udpv6_rcv() steals the
socket via inet6_steal_sock(), which also lacks a family check, and
queues the IPv6 skb on the AF_INET socket.

recvmsg() on that socket then runs the IPv4 udp_recvmsg(), which
interprets the IPv6 skb control block as IPv4 IP options. When
IP_RETOPTS is enabled on the target socket, __ip_options_echo()
copies up to 153 bytes of attacker-controlled data from the IPv6
Destination Options extension header into the 40-byte option-data
area of the stack-allocated optbuf in ip_cmsg_recv_retopts():

Really you need to ask your LLM to not slow down linux fast paths.

Fix bpf_sk_assign() and bpf_sk_assign_tcp_reqsk() instead.

Thank you.

pw-bot: cr