[PATCH net-next] ipv6: initialize ipcm6_cookie before parsing control messages

[Fernando Fernandez Mancera]

On 2026-07-21 16:45 +0200, Fernando Fernandez Mancera wrote:
> On Thu, 09 Jul 2026 16:32:30 +0800, Wayen Yan <win847 at gmail.com> wrote:
> > ip6_datagram_send_ctl() parses both SOL_IPV6 and SOL_SOCKET control
> > messages. For SOL_SOCKET messages it passes ipc6->sockc to
> > __sock_cmsg_send(), which updates fields such as tsflags with
> > read-modify-write operations.
> > 
> > The IPV6_2292PKTOPTIONS and flowlabel option paths only set ipc6.opt
> > before calling ip6_datagram_send_ctl(). If a SOL_SOCKET control message
> > such as SO_TIMESTAMPING_* or SCM_TS_OPT_ID is present, this can read
> > uninitialized sockc state.
> > 
> > Initialize the ipcm6_cookie with ipcm6_init_sk(), as the normal IPv6
> > sendmsg paths do, before overriding ->opt with the temporary option
> > buffer.
> > 
> > Signed-off-by: Wayen Yan <win847 at gmail.com>
> >
> 
> Reviewed-by: Fernando Fernandez Mancera <fmancera at suse.de>
> 
> Thanks!

Now that I think about it, shouldn't this go to net tree with a proper
fixes tag?