tcp_make_synack() sets skb->sk of a SYN-ACK to the request socket. If the SYN-ACK destination is multicast, ip_mc_output() calls sk_mc_loop() on it, and inet_test_bit(MC_LOOP, sk) reads inet_flags, which is past the end of the smaller request_sock object. KASAN reports a slab-out-of-bounds (or slab-use-after-free) read in sk_mc_loop() from tcp_v4_send_synack() when a SYN with a multicast source address reaches a listener. Map the socket to the full socket before reading its flags. Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener") Signed-off-by: Theodor Arsenij Larionov Trichkine --- net/core/sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/sock.c b/net/core/sock.c index e8551df8330f..1302c1e848b2 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -769,6 +769,7 @@ bool sk_mc_loop(const struct sock *sk) { if (dev_recursion_level()) return false; + sk = sk_const_to_full_sk(sk); if (!sk) return true; /* IPV6_ADDRFORM can change sk->sk_family under us. */ base-commit: 6d25ffca055a77787c21a36b66c253f76239411b -- 2.34.1