[PATCH ipsec] xfrm4: use a full socket for local errors

xfrm4_local_error() passes skb->sk to inet_sk() and ip_local_error()
without ensuring it points to a full socket. TCP SYN-ACK skbs can be owned
by TCP_NEW_SYN_RECV request sockets.

When IP-TFS rejects such an skb because it exceeds its payload MTU, the
local error path treats the request socket as a struct inet_sock. KASAN
reports a slab-out-of-bounds read in ip_local_error() beyond the
request_sock_TCP allocation.

Resolve the skb owner with skb_to_full_sk() before accessing inet_sock
state or reporting the error. This maps a request socket to its listener
and rejects sockets that cannot be used as full sockets, matching what
commit 6973a21ee73c ("ipv6: xfrm: use full sockets in local error paths")
did for xfrm6_local_error().

Fixes: b00897b881f7 ("xfrm4: Don't call icmp_send on local error")
Cc: stable@vger.kernel.org
Reported-by: TencentOS Corvus AI <redacted>
Link: https://lore.kernel.org/netdev/20260908224856.1591189-1-kuba@kernel.org/ (local)
Assisted-by: tencentos-corvus-ai:hy4-preview
Signed-off-by: Fourie Zhang <redacted>
---
A KASAN reproducer for this issue is available if requested.

 net/ipv4/xfrm4_output.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 0ae67d537499..cf6be50485d1 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c

@@ -39,8 +39,11 @@ int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu)
 {
 	struct iphdr *hdr;
+	struct sock *sk = skb_to_full_sk(skb);
+
+	if (!sk)
+		return;
 
 	hdr = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
-	ip_local_error(skb->sk, EMSGSIZE, hdr->daddr,
-		       inet_sk(skb->sk)->inet_dport, mtu);
+	ip_local_error(sk, EMSGSIZE, hdr->daddr, inet_sk(sk)->inet_dport, mtu);
 }

-- 
2.43.7