Re: [PATCH net] udp: do not use a cross-family sk_rx_dst in early demux

[Kuniyuki Iwashima <kuniyu@google.com>]

On Fri, 06 Nov 2026 12:01:35 +0100, Eric Dumazet wrote:
> A dual-stack UDP socket connected to a v4-mapped address can receive
> both IPv4 packets and IPv6 packets using v4-mapped addresses:
> ip6_rcv_core() no longer rejects a v4-mapped source since commit
> dcc32f4f183a ("ipv6: weaken the v4mapped source check"), which kept
> that check only in tcp_v6_conn_request(). ipv6_portaddr_hash() hashes
> v4-mapped addresses like IPv4 ones, so both early demux handlers find
> the socket, and both __udp4_lib_rcv() and __udp6_lib_rcv() store their
> input dst in the same sk->sk_rx_dst.
> 
> udp_v6_early_demux() validates the cached dst with dst_check(), but
> ipv4_dst_check() ignores the cookie, so an IPv4 dst gets attached to
> an IPv6 skb. ip6_rcv_finish_core() then skips the route lookup and
> ip_local_deliver() parses the IPv6 header as an IPv4 one: the IPv6
> next header and hop limit are read as a fragment offset, and the IPv4
> protocol is taken from a source address byte.
> 
> The reverse direction looks possible too: per-cpu dsts of IPv6 routes
> using nexthop objects have rt->sernum set, and ip6_dst_check() then
> ignores the cookie, so udp_v4_early_demux() can attach an IPv6 dst to
> an IPv4 skb.
> 
> Kyle Zeng reported that such a packet can reach XFRM input still
> holding the prefetched, non refcounted, socket set by early demux,
> which can then outlive its RCU grace period.
> 
> Only use the cached dst if its family matches the packet. Otherwise
> fall back to a regular route lookup.
> 
> TCP does not have the same problem: sk_ehashfn() hashes a v4-mapped
> socket with inet_ehashfn(), while IPv6 lookups use inet6_ehashfn(),
> so IPv6 packets do not normally find a v4-mapped TCP socket.
> 
> Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast")
> Fixes: c9f2c1ae123a ("udp6: fix socket leak on early demux")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>