From d6454b486f826992bf706cd5ec9ecfd7001e1c3d Mon Sep 17 00:00:00 2001
From: Lucas Manning <lucasmanning@google.com>
Date: Mon, 10 Feb 2025 12:11:55 -0800
Subject: [PATCH] Lock around packetmmap cooked field and check for
 PACKET_RESERVE opt size.

Reported-by: syzbot+ca91395278b8bbe45820@syzkaller.appspotmail.com
Reported-by: syzbot+7786024ead82f25b39c5@syzkaller.appspotmail.com
PiperOrigin-RevId: 725302503
---
 pkg/sentry/socket/netstack/packetmmap/endpoint.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkg/sentry/socket/netstack/packetmmap/endpoint.go b/pkg/sentry/socket/netstack/packetmmap/endpoint.go
index a2c30d302..ba09321b1 100644
--- a/pkg/sentry/socket/netstack/packetmmap/endpoint.go
+++ b/pkg/sentry/socket/netstack/packetmmap/endpoint.go
@@ -68,8 +68,9 @@ type Endpoint struct {
 
 	// +checklocks:mu
 	mode ringBufferMode
+	// +checklocks:mu
+	cooked bool
 
-	cooked    bool
 	packetEP  stack.MappablePacketEndpoint
 	reserve   uint32
 	nicID     tcpip.NICID
@@ -192,6 +193,7 @@ func (m *Endpoint) HandlePacket(nicID tcpip.NICID, netProto tcpip.NetworkProtoco
 	)
 
 	m.mu.Lock()
+	cooked := m.cooked
 	if !m.rxRingBuffer.hasRoom() {
 		m.mu.Unlock()
 		m.stack.Stats().DroppedPackets.Increment()
@@ -208,7 +210,7 @@ func (m *Endpoint) HandlePacket(nicID tcpip.NICID, netProto tcpip.NetworkProtoco
 	}
 
 	pktBuf := pkt.ToBuffer()
-	if m.cooked {
+	if cooked {
 		pktBuf.TrimFront(int64(len(pkt.LinkHeader().Slice()) + len(pkt.VirtioNetHeader().Slice())))
 		// Cooked packet endpoints don't include the link-headers in received
 		// packets.