cipso_v4_error() recompiles the IP options of the offending packet with __ip_options_compile() before echoing them in an ICMP error. __ip_options_compile() updates Record Route and Timestamp options in place. cipso_v4_error() is called from the LSM socket receive hooks through netlbl_skbuff_err(). ip_rcv_options() unshared the IPv4 header earlier, but at socket delivery time the skb can again be a clone sharing its data with other skbs, such as the per-socket clones made for raw sockets or multicast/broadcast delivery. Writing to the options then modifies packet data seen by the other users of the buffer, and a concurrent recompilation would hit the same check-then-write race as the one fixed in ipv4_send_dest_unreach(). Make the header private before recompiling options, as ip_rcv_options() already does. If the copy fails, do not send the ICMP error. Fixes: 3da1ed7ac398 ("net: avoid use IPCB in cipso_v4_error") Reported-by: Kyle Zeng Cc: Paul Moore Cc: linux-security-module@vger.kernel.org Signed-off-by: Eric Dumazet --- The issue was found by an AI code review agent. It was not reproduced, and the fix was only build-tested. net/ipv4/cipso_ipv4.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index e65a3f29d2caf31c34cc5aaaf862257d7d374275..f5f6a812ab9ef05117e002779baf136e615c043d 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -1725,6 +1725,9 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) * so we can not use icmp_send and IPCB here. */ + if (skb_unclone(skb, GFP_ATOMIC)) + return; + memset(&parm, 0, sizeof(parm)); parm.opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr); rcu_read_lock(); -- 2.53.0