Re: [PATCH] ip6mr: Serialize multicast router socket ownership

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Oct 29, 2026 at 09:22:21PM -0700, Kyle Zeng wrote:
> MRT6_TABLE checks whether the socket owns its current table before
> acquiring RTNL. MRT6_INIT also looks up its table before taking RTNL.
> Consequently, concurrent TABLE and INIT calls can initialize the old
> table and then change the socket's selected table. Another INIT can
> register the same socket in the new table.
> 
> rawv6_close() calls ip6mr_sk_done(), which clears only the first table
> owned by the socket. After the socket's RCU-delayed free, the other
> table retains a dangling mroute_sk pointer. A subsequent multicast cache
> report passes that pointer to sock_queue_rcv_skb_reason(). This produces
> a KASAN slab-use-after-free in sk_filter_trim_cap().
> 
> Look up the selected table in ip6mr_sk_init() after acquiring RTNL.
> Likewise, re-read the current table and check its owner under RTNL in
> MRT6_TABLE before updating the selection. This preserves the single-table
> ownership invariant shared with ip6mr_sk_done(), without changing the
> locking of the other multicast socket options.
> 
> Fixes: d1db275dd3f6 ("ipv6: ip6mr: support multiple tables")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>