Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Antoine Tenart <atenart@kernel.org>]

On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > index b965258cf..bdea82543 100644
> > --- a/net/ipv6/raw.c
> > +++ b/net/ipv6/raw.c
> > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> >  	if (unlikely(!skb))
> >  		return 0;
> >  
> > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > +	rt = dst_rt6_info(skb_dst(skb));
> > +
> >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> >  	 * in the error path. Since skb has been freed, the dst could
> >  	 * have been queued for deletion.
> 
> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Doesn't this change the device seen by the nf hook / used for the stats?