[PATCH net v2] cipso: adjust cached option offsets when removing CIPSO

patchwork-bot+netdevbpf at kernel.org patchwork-bot+netdevbpf at kernel.org
Thu Oct 8 02:30:07 UTC 2026


Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba at kernel.org>:

On Tue,  6 Oct 2026 12:51:08 +0900 you wrote:
> cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
> cached offsets for options that follow them.
> 
> For example, with a valid 10-byte CIPSO option followed by a seven-byte
> RR option, parsing records rr at offset 30.  Removing CIPSO moves RR to
> offset 20, while the cached offset remains 30.  Consumers such as
> ip_forward_options() and __ip_options_echo() then access the wrong bytes;
> the latter may interpret packet data as the option length and copy it into
> fixed-size option storage.
> 
> [...]

Here is the summary with links:
  - [net,v2] cipso: adjust cached option offsets when removing CIPSO
    https://git.kernel.org/netdev/net/c/6d25ffca055a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html





More information about the Linux-security-module-archive mailing list