netdev - Re: [PATCH v1 net 2/2] sctp: Clear pktoptions and rxpmtu in sctp_v6_copy_ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAAVpQUDH711WYOn68SCJDzNO+d0L19erDBQrXg4tb3_JBwA-iA@mail.gmail.com>
Date: Tue, 9 Dec 2025 20:48:22 -0800
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: Xin Long <lucien.xin@...il.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>, "David S . Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Simon Horman <horms@...nel.org>, Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, 
	syzbot+ec33a1a006ed5abe7309@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net 2/2] sctp: Clear pktoptions and rxpmtu in sctp_v6_copy_ip_options().

On Tue, Dec 9, 2025 at 2:26 PM Xin Long <lucien.xin@...il.com> wrote:
>
> On Mon, Dec 8, 2025 at 8:37 AM Kuniyuki Iwashima <kuniyu@...gle.com> wrote:
> >
> > syzbot reported the splat below. [0]
> >
> > Since the cited commit, the child socket inherits all fields
> > of its parent socket unless explicitly cleared.
> >
> > sctp_v6_copy_ip_options() only clones np->opt.
> >
> > So, leaving pktoptions and rxpmtu results in double-free.
> >
> > Let's clear the two fields in sctp_v6_copy_ip_options().
> >
> Hi Kuniyuki,
>
> The call trace below seems all about ipv4 options, could you explain a bit more?
>

Oh sorry, when I drafted a patch a month ago, I cleared
newinet->inet_opt instead, and I found other IPv6 options
could have the same issue.

https://syzkaller.appspot.com/text?tag=Patch&x=16e930b4580000

I'll add inet_opt patch with this stacktrace and separate IPv6
change.