Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3582092imu;
        Mon, 24 Dec 2018 05:00:05 -0800 (PST)
X-Google-Smtp-Source: ALg8bN457cGgAOXrZX9t3BNIXPmVlWi/LCUzNx33nNAmGCgAMHCKdynfLkH2zh/fOcinXOvOG2a9
X-Received: by 2002:a63:88c7:: with SMTP id l190mr12020097pgd.110.1545656404985;
        Mon, 24 Dec 2018 05:00:04 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1545656404; cv=none;
        d=google.com; s=arc-20160816;
        b=GigOeaBFe+QrlguI5a8Qf+nBacZykcLAJUn5FMfP8PZxtJaJQNahVTvZnUUq3XUI5t
         ceXamzibdMnYk4Sit1zTViTXN4IggIulImzGI7Zo/x2O05noSY8FHJDljhuVhrGBrx83
         EBHn4X3TPBCBIkK5Iy1bYab5Jxwq293FaYlfAekDPWdZAGxEDPYDHa1mrzD+tIL1MCFX
         BTtdawVLItInVr9BitxyWzieBirmXO8QZzcvBJyK+XmxSYRYEvydCeX/MLPeAPnTQFEV
         qiNB9mBSLhEDnpZbbyHo5L2wFAtASdKYPlWc9K3rRJsYXaT62hBLp8iTWyoJEs9BWCfI
         A6DA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-id:precedence:sender:content-transfer-encoding:message-id:date
         :mime-version:subject:to:from:dkim-signature;
        bh=Z4uSVTBLRgAM4AlUGVKfQwZKhnxzWsjeHrBKDYqpnVE=;
        b=fVwQu7RShoy+sVxJn8IRaPccHtQM8053MmhAAZ5kTnc5H50vhSwseh87PgiTawqnJL
         CBNPBE9i7oJJo67dxrpBhUSwHNh1RTQ4doSKNtykpBGNCGw2PSGzrPHgEZRcvTVOKN/g
         irbcDemmsOcn2/ugu/4dmSs2dIbFzbqyT4RKX4woY3rzJeVGlW8k80GvBlzETHOe0CeI
         NliNLd/+F4LoTXNJc0J7AYFxhIrsBL4ewQLD1J1SHwdyDiXqF//U2biUPFU8RDtpznba
         4rFh002Esz4PBEJGpHlD9GHDWTG99Xx0JER/PKPxMxkTwlOcJJuCQcn+/K/CvW+2FWf8
         5AjQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@yandex.ru header.s=mail header.b="pU7I/mGy";
       spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yandex.ru
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
        by mx.google.com with ESMTP id d15si26144340pgt.498.2018.12.24.04.59.20;
        Mon, 24 Dec 2018 05:00:04 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@yandex.ru header.s=mail header.b="pU7I/mGy";
       spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yandex.ru
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1725905AbeLXM5T (ORCPT <rfc822;xuyizhaos@gmail.com> + 99 others);
        Mon, 24 Dec 2018 07:57:19 -0500
Received: from forward100j.mail.yandex.net ([5.45.198.240]:46364 "EHLO
        forward100j.mail.yandex.net" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1725355AbeLXM5T (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 24 Dec 2018 07:57:19 -0500
Received: from mxback2o.mail.yandex.net (mxback2o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::1c])
        by forward100j.mail.yandex.net (Yandex) with ESMTP id D710820813D3
        for <linux-kernel@vger.kernel.org>; Mon, 24 Dec 2018 15:57:15 +0300 (MSK)
Received: from localhost (localhost [::1])
        by mxback2o.mail.yandex.net (nwsmtp/Yandex) with ESMTP id tNZqorhhrB-vFoWXZiF;
        Mon, 24 Dec 2018 15:57:15 +0300
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1545656235;
        bh=Z4uSVTBLRgAM4AlUGVKfQwZKhnxzWsjeHrBKDYqpnVE=;
        h=From:To:Subject:Date:Message-Id;
        b=pU7I/mGyDH37HTRleX4MR+BprzE9Mc54Aya/05pKGUj+dFPB+aX0RdIr51bu5jZ9F
         yf3iacMs8Agxyn922NJVsjU9y6Wi3NijD0Cwox5k4REfik2mLzIs1cDTNRqQ4Dq/uZ
         U3rZRyE45yVP50BLBn3mZsP9BbygDNIaIa85p6Xg=
Authentication-Results: mxback2o.mail.yandex.net; dkim=pass header.i=@yandex.ru
Received: by sas1-02732547ccc0.qloud-c.yandex.net with HTTP;
        Mon, 24 Dec 2018 15:57:15 +0300
From:   Nazarov Sergey <s-nazarov@yandex.ru>
To:     linux-kernel@vger.kernel.org
Subject: Incorrect use IPCB in icmp_send code
MIME-Version: 1.0
X-Mailer: Yamail [ http://yandex.ru ] 5.0
Date:   Mon, 24 Dec 2018 15:57:15 +0300
Message-Id: <9280561545656235@sas1-02732547ccc0.qloud-c.yandex.net>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hello!
icmp_send routine calls ip_option_echo, which uses IPCB to take skbuff compiled IP options.
But icmp_send could be called from TCP level too (security_sock_rcv_skb - cipso_v4_error for INET stream connection, for example).
After moving IP header data to the end of the struct tcp_skb_cb, this could lead to memory corruption when IP options copying.
Thanks.