ip_icmp_error() and ipv6_icmp_error() clone a received ICMP skb before building its error queue entry. skb_clone() preserves the complete control buffer, while the IP receive paths initialize only the portion aliased by sock_exterr_skb::header. The two functions initialize ee, addr_offset, and port, but leave the final byte containing opt_stats and unused untouched. A TCX classifier can leave bpf_skb_data_end::data_end across that byte, forging opt_stats and making __sock_recv_timestamp() pass skb->len bytes from skb->data to put_cmsg(). For a non-linear ICMP skb, this reads beyond its linear head. Initialize both bitfields in the two clone-based producers. Do not clear the whole sock_exterr_skb because the error receive paths consume the saved IP control-buffer header. usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_small_head' (offset 72, size 59964)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: usercopy_abort (mm/usercopy.c:102) Call Trace: __check_heap_object (mm/slub.c:8146) __check_object_size (mm/usercopy.c:258) put_cmsg (net/core/scm.c:276) __sock_recv_timestamp (net/socket.c:1061) ip_recv_error (net/ipv4/ip_sockglue.c:550) udp_recvmsg (net/ipv4/udp.c:2034) inet_recvmsg (net/ipv4/af_inet.c:896) sock_recvmsg (net/socket.c:1159) ____sys_recvmsg (net/socket.c:2918) ___sys_recvmsg (net/socket.c:2961) __sys_recvmsg (net/socket.c:2993) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Kernel panic - not syncing: Fatal exception With HARDENED_USERCOPY enabled, the reproducer aborted the unpatched kernel on its first packet. With runtime usercopy checks disabled and KASAN left in report mode, the same recvmsg() returned 59,964 control-message data bytes sourced past a 704-byte skb head. Beyond offset 1,024, 58,932 bytes differed from the prefilled userspace marker, including 6,288 nonzero bytes. The patched build completed 2,000 packets under both configurations without a forged SCM_TIMESTAMPING_OPT_STATS message or sanitizer report. Networking selftests were not run. Fixes: 4ef1b2869447 ("tcp: mark skbs with SCM_TIMESTAMPING_OPT_STATS") Cc: stable@vger.kernel.org Reported-by: Signed-off-by: Weiming Shi --- net/ipv4/ip_sockglue.c | 2 ++ net/ipv6/datagram.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index a55ef327ec93..3ab84a4c31e5 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -429,6 +429,8 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, serr->addr_offset = (u8 *)&(((struct iphdr *)(icmp_hdr(skb) + 1))->daddr) - skb_network_header(skb); serr->port = port; + serr->opt_stats = 0; + serr->unused = 0; if (skb_pull(skb, payload - skb->data)) { if (inet_test_bit(RECVERR_RFC4884, sk)) diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index ca3605acb433..85f646f8d059 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -330,6 +330,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, serr->addr_offset = (u8 *)&(((struct ipv6hdr *)(icmph + 1))->daddr) - skb_network_header(skb); serr->port = port; + serr->opt_stats = 0; + serr->unused = 0; __skb_pull(skb, payload - skb->data); -- 2.56.0