Re: [syzbot] [netfilter?] KASAN: slab-use-after-free Read in ip_skb_dst_mtu

Hillf Danton
2024-03-09T08:45:48Z

On Wed, 06 Mar 2024 02:57:18 -0800
> syzbot found the following issue on:
>
> HEAD commit: 805d849d7c3c Merge tag 'acpi-6.8-rc7' of git://git.kernel...
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1025fa6a180000

#syz test https://github.com/fbq/linux.git rcu-exp.2024.01.29b

--- x/drivers/net/ipvlan/ipvlan_core.c
+++ y/drivers/net/ipvlan/ipvlan_core.c
@@ -426,6 +426,7 @@ static noinline_for_stack int ipvlan_pro
.daddr = ip4h->daddr,
.saddr = ip4h->saddr,
};
+ struct sock *sk;

rt = ip_route_output_flow(net, &fl4, NULL);
if (IS_ERR(rt))
@@ -439,7 +440,12 @@ static noinline_for_stack int ipvlan_pro

memset(IPCB(skb), 0, sizeof(*IPCB(skb)));

+ sk = skb->sk;
+ if (!sk)
+ goto err;
+ refcount_inc(&sk->sk_wmem_alloc);
err = ip_local_out(net, skb->sk, skb);
+ sk_free(sk);
if (unlikely(net_xmit_eval(err)))
DEV_STATS_INC(dev, tx_errors);
else
--