Re: [PATCH net] ipv4: fix use-after-free in fib_nhc_update_mtu()

[David Ahern <dsahern@kernel.org>]

On 7/31/26 10:29 AM, Chengfeng Ye wrote:
> fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
> RTNL does not serialize this walk with PMTU exception updates. The walk
> uses rcu_dereference_protected() with a constant true condition without
> holding either fnhe_lock or an RCU read-side critical section.
> 
> The following interleaving can therefore occur:
> 
>   CPU 0                              CPU 1
>   fib_nhc_update_mtu()               update_or_create_fnhe()
>     load fnhe                          spin_lock_bh(&fnhe_lock)
>                                        fnhe_remove_oldest()
>                                          unlink fnhe
>                                          kfree_rcu(fnhe, rcu)
>     <quiescent state>
>     access fnhe after grace period
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
>   Read of size 8 at addr ffff888107d49000 by task poc/90
>   Call Trace:
>    fib_nhc_update_mtu+0x3df/0x410
>    fib_sync_mtu+0x7a/0xd0
>    fib_netdev_event+0x229/0x3f0
>    netif_set_mtu_ext+0x33a/0x570
>    dev_set_mtu+0x88/0x120
>   Allocated by task 89:
>    update_or_create_fnhe+0xa80/0x1110
>    __ip_rt_update_pmtu+0x8f2/0xcd0
>    ipv4_sk_update_pmtu+0x49e/0x690
>    udp_err+0xd92/0x1080
>   Freed by task 0:
>    __kasan_slab_free+0x43/0x70
>    kvfree_rcu_cb+0x12f/0x420
>    rcu_core+0x509/0x18e0
> 
> Protect the full walk with rcu_read_lock() and use rcu_dereference()
> for the RCU-published pointers. This prevents reclaim from completing
> until all references held by the walk have been dropped, without
> serializing PMTU updates against the entire hash-table traversal.
> 
> Fixes: af7d6cce5369 ("net: ipv4: update fnhe_pmtu when first hop's MTU changes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> ---
>  net/ipv4/fib_semantics.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>