[PATCH mptcp-next v6 01/10] ipv4: fix uninitialized memory in zerocopy cmsg

From: Geliang Tang <[email protected]>

When SOF_TIMESTAMPING_OPT_CMSG is enabled and applications read
MSG_ZEROCOPY completion notifications from the error queue, the
ipv4_datagram_support_cmsg() function attempts to read ip_hdr(skb)->saddr
to populate IP_PKTINFO cmsg data. However, zerocopy completion notification
skbs don't have IP headers, causing this read to access uninitialized
memory which is then leaked to userspace via put_cmsg().

The issue occurs because the function checks PKTINFO_SKB_CB(skb)->ipi_ifindex
(which aliases the ops pointer in ubuf_info_msgzc stored in skb->cb), and
if non-NULL, proceeds to read ip_hdr(skb)->saddr without verifying that
the skb actually has an IP header.

Fix this by adding an early check for SO_EE_ORIGIN_ZEROCOPY and returning
false, since zerocopy completion notifications don't have IP headers and
IP_PKTINFO cmsg is not applicable to them.

Fixes: f2457533c4d3 ("ipv4: support IP_PKTINFO cmsg for SO_TIMESTAMPING")
Signed-off-by: Geliang Tang <[email protected]>
---
 net/ipv4/ip_sockglue.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index a55ef327ec93..59513f15e522 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -504,6 +504,12 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk,
 	if (ee_origin == SO_EE_ORIGIN_LOCAL)
 		return false;
 
+	/* Zerocopy completion notifications don't have IP headers,
+	 * so IP_PKTINFO cmsg is not applicable.
+	 */
+	if (ee_origin == SO_EE_ORIGIN_ZEROCOPY)
+		return false;
+
 	/* Support IP_PKTINFO on tstamp packets if requested, to correlate
 	 * timestamp with egress dev. Not possible for packets without iif
 	 * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
-- 
2.53.0