From: Zhiling Zou ipmr_cache_report() builds short IGMP reports for mrouted from a packet that may be a synthetic RTM_GETROUTE query. That query skb stores the netlink requester portid in NETLINK_CB(), but the report is delivered to a raw IPv4 socket, whose receive path interprets skb->cb as IPCB(). Commit bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg") added IP_PKTINFO support by calling ipv4_pktinfo_prepare() on the original packet and then copying the whole control buffer to the report skb. For synthetic route-query packets, this copies NETLINK_CB bytes into IPCB and lets a controlled portid corrupt IPCB(skb)->opt. With IP_RECVOPTS or IP_RETOPTS enabled, the raw socket receive path can then copy past the short report packet or overflow the stack option buffer. Keep the IP_PKTINFO support, but initialize the report skb control buffer and copy only the pktinfo fields prepared by ipv4_pktinfo_prepare(). Fixes: bb7403655b3c ("ipmr: support IP_PKTINFO on cache report IGMP msg") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: Codex:gpt-5.6-terra Signed-off-by: Zhiling Zou Signed-off-by: Ren Wei --- net/ipv4/ipmr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 1d9a4ac14fcef..783de5de02ddd 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1061,6 +1061,7 @@ static int ipmr_cache_report(const struct mr_table *mrt, + struct in_pktinfo *info; struct sock *mroute_sk; struct igmphdr *igmp; struct igmpmsg *msg; struct sk_buff *skb; int ret; @@ -1113,7 +1114,10 @@ static int ipmr_cache_report(const struct mr_table *mrt, msg->im_vif = vifi; msg->im_vif_hi = vifi >> 8; ipv4_pktinfo_prepare(mroute_sk, pkt, false); - memcpy(skb->cb, pkt->cb, sizeof(skb->cb)); + info = PKTINFO_SKB_CB(skb); + memset(skb->cb, 0, sizeof(skb->cb)); + info->ipi_ifindex = PKTINFO_SKB_CB(pkt)->ipi_ifindex; + info->ipi_spec_dst = PKTINFO_SKB_CB(pkt)->ipi_spec_dst; /* Add our header. * Note that code, csum and group fields are cleared. */ -- 2.43.0