Re: [PATCH net v3 1/1] ip: orphan prefetched skbs before multicast forwarding

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Aug 13, 2026 at 12:36:38AM +0800, Zhiling Zou wrote:
> IPv4 and IPv6 input preserve an skb->sk association installed by
> bpf_sk_assign() so that local delivery can use the selected socket under
> RCU. Both address families can also prefetch a socket in UDP early demux.
> In both paths (BPF and UDP early demux) a reference is not guaranteed to
> be held on the socket.
> 
> When a multicast packet is not locally deliverable, IPv6 hands the
> original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the
> original skb when local delivery is not needed. Either path can put the
> skb on an unresolved multicast route queue or forward it after the
> receive-side RCU section ends.
> 
> After the prefetched socket is destroyed, a later skb free invokes
> sock_pfree() and dereferences the stale skb->sk. Orphan the skb before
> each non-local multicast forwarding path. Local delivery retains the
> original skb; the existing skb_clone() calls provide multicast forwarding
> with a socket-free clone.
> 
> Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
> Fixes: 08842c43d016 ("udp: no longer touch sk->sk_refcnt in early demux")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

I read the feedback from Sashiko [1], but calling skb_orphan() in
ip{,6}mr_cache_unresolved() will not cover the case where an skb with a
pre-fetched socket is multicast forwarded and ends up waiting in some
qdisc. This can be accomplished by an unprivileged user via UDP early
demux.

The case that Sashiko is referring to requires bpf_sk_assign() which is
not available to unprivileged users, AFAIU. It's also not specific to
ipmr.

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/0c52eb3d7532aaf8bccf37e0f7c922143c639735.1786552223.git.zhilinz%40nebusec.ai