[PATCH mptcp-next v7 1/9] ipv4: fix uninitialized memory in zerocopy cmsg

From: Geliang Tang <[email protected]>

When SOF_TIMESTAMPING_OPT_CMSG is enabled and applications read
MSG_ZEROCOPY completion notifications from the error queue, the
ipv4_datagram_support_cmsg() function attempts to read ip_hdr(skb)->saddr
to populate IP_PKTINFO cmsg data. However, zerocopy completion notification
skbs don't have IP headers, causing this read to access uninitialized
memory which is then leaked to userspace via put_cmsg().

This is because the function checks PKTINFO_SKB_CB(skb)->ipi_ifindex (which
aliases the ops pointer in ubuf_info_msgzc stored in skb->cb), and if
non-NULL, proceeds to read ip_hdr(skb)->saddr without verifying that the
skb actually has an IP header.

Fix this by adding an early check for SO_EE_ORIGIN_ZEROCOPY and returning
false, since zerocopy completion notifications don't have IP headers and
IP_PKTINFO cmsg is not applicable to them.

Fixes: 829ae9d61165 ("net-timestamp: allow reading recv cmsg on errqueue with origin tstamp")
Signed-off-by: Geliang Tang <[email protected]>
---
 net/ipv4/ip_sockglue.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index a55ef327ec93..59513f15e522 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -504,6 +504,12 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk,
 	if (ee_origin == SO_EE_ORIGIN_LOCAL)
 		return false;
 
+	/* Zerocopy completion notifications don't have IP headers,
+	 * so IP_PKTINFO cmsg is not applicable.
+	 */
+	if (ee_origin == SO_EE_ORIGIN_ZEROCOPY)
+		return false;
+
 	/* Support IP_PKTINFO on tstamp packets if requested, to correlate
 	 * timestamp with egress dev. Not possible for packets without iif
 	 * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
-- 
2.53.0