From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f179.google.com (mail-qt1-f179.google.com [209.85.160.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC8EF301493 for ; Fri, 31 Jul 2026 13:52:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785505928; cv=none; b=p7Ru7VrU7QMQXxs49Knbu0yXXUsUmi3fd4ZcYtwELkrrqo95Cq8CLpuybuVnfKVt8h/v3ZUIg1F/C9LNwYPLt2NFEPvKUJxmnKNKZsFV182bc4ae8UlYoF7v4s4G+J7fTCPUtllQdcCT2FbgqUVBNeWzHElgDBYKjYpcRR6VbH0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785505928; c=relaxed/simple; bh=zdj9k7TJgiCnRnShmH+9w9H4vBvrzOYJWvCK6aaGOCw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=P6p3BinVeKOsDyHMScQArQNilAURFqFzijurSK95Lk0u2kMVrEFeUTDIjn+b0M3TpsgxzdV1FUNAWPCZ7GdZHt/M4wxAzI3StKxVU4mzaz61r/PTps6hHpF15e0jKvi4aLsuA5/ds9GYL5kiDz56HmK5fpxvWD9sUHg1FVS8VMI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=VDCpRNNK; arc=none smtp.client-ip=209.85.160.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="VDCpRNNK" Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-52b3934af3fso8696911cf.1 for ; Fri, 31 Jul 2026 06:52:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1785505924; x=1786110724; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pq0Vt2tNa97HpfIWCHBxkOn2jM/2Q4uM9td5pkD655g=; b=VDCpRNNKSsaEXTvDXXP8Q4vmQG22XewQ2lfO39qebzFrSx3dOLSH3xjBgk0Dp95Kdm 5qm+vSyQa89QUZdf2qm3/OXkkyjAnTJr7ofXo+DPy1hC2pjE3KRtjTnaS5iB/U6fm5qm VpfyTVFk01jsbPjic63IpB23u8bjjcXqbxb4ztlQQy9dunmuy+xqV3DNCdy9eaLgkiY1 upmrLn6XhukZTH74OJAhJV3NH7X39VfTEDOyt2IjPh48g1xQl10GCicIBrYqg2NHkI6b tZ3kXDxAYPRteJSr8YC3z5yvApodoRC/ycjv9B7mWVazV14vxUjyGJZ8oMTrY2tZCOw/ TKdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785505924; x=1786110724; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pq0Vt2tNa97HpfIWCHBxkOn2jM/2Q4uM9td5pkD655g=; b=CDFa2iVXXORxus5w+Si3WeHUFs+HTSxYfKve//itgdRRL3QJ/bshBIiGmMmc2CORKK VxL+CXBUikZRWvdr0F5UYDY8Hxa1V0XO8GT+5hQQGqEt6lZBeJvPgO08p0bRg7f3Q3jc LPp5VTxhXCQ3pjSQ3wu0RXvviJ4kWYl+5wYU9yi+5YL8qsLPFyh4CQbC9oPjFwcRbHkX /+WLwQBWjpJZhdKRhnbv6gkhHepiRgXO/bDBQKN6kji/7QJGpBTyKxmEHcis8xSBwtaE Ta6Iafj2jsWxIXX9mA5pFStR2U77eyo0wp1/qmGx31JdqcAhWfj0LPqncFZCL5H6kSsy ZbwA== X-Forwarded-Encrypted: i=1; AHgh+Rqd0TEaPxeBZkFulx/govr1X/7mL5kS/TGnNjbcS4XCEu+RfjCOg66ii9uu47nzl2VXFlRX/DCi8Py9WEM=@vger.kernel.org X-Gm-Message-State: AOJu0YwWN81jSznrEMio6igLEc2COQs79DsChm/Zym8iDm54tHIohnpe bxQNniiqFwJyv2s9PAepZyisCOQSkQoeFlcuPeZdQlRhIdbNSL42Ko9Ze6maIA3mpTc= X-Gm-Gg: AR+sD11OaIBKu+CPrsTeTnZO/hqYYYGtLeCw41UdFlOWZRIl2cmtADPCyNWPAntQrLw awE9KueTINdQwCEiHPaYke3FpPzJn998M57t0ZQq0R8v6B6LRAI4tKOoz9WgLQRlh8iGykKQrNo QjDONvhtSQ1bxjwznEd4nmM6KAOOIQp1C2LLoLkP8kCfdcaZOfcIuxpkzMjal/UediUHULpvPla Tlv4SGQ0mJlZ/UkgVii3TwpGrhLvDeZbTeQJj8NOSMoAaVED0Rxw0OM1t2t8GV7taZ2ORT6rmKS Uu8qZ0k2LayzzcvjLDUKAbdYo2ymCE6wabqEyBfLG2kJYUrh6rtSzCrTejg2qpQWJsFi1XSuPf+ lwG956YceNP51/G46B4qwDT4HAMJYEzhlLYXmuDYTQW8PwWObctpiMtp+XshKBo5ZW5A287aULj 9Y1RvRXJiJqTlrv6p4Tv9lxsLIpvAoaeH7AzxSZUzoEftdS+aQ7G4X7Z55r86KNP/yCA== X-Received: by 2002:a05:622a:c15:b0:517:85e1:388f with SMTP id d75a77b69052e-52b5678f96amr3179611cf.30.1785505924426; Fri, 31 Jul 2026 06:52:04 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id d75a77b69052e-52b4eb6a84csm8108171cf.18.2026.07.31.06.52.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2026 06:52:04 -0700 (PDT) From: David Lee To: dsahern@kernel.org, idosch@nvidia.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: David Lee , Kyle Zeng , Dominik 'Disconnect3d' Czarnota , horms@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] ipv6: prevent in6_dev_get() from resurrecting inet6_dev Date: Fri, 31 Jul 2026 13:52:01 +0000 Message-ID: <20260731135202.566337-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed. Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller. Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.") Bug found and triaged by OpenAI Security Research and validated by Trail of Bits. Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber Signed-off-by: Kyle Zeng --- Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed. include/net/addrconf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 8ced27a82..e67642459 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -405,8 +405,8 @@ static inline struct inet6_dev *in6_dev_get(const struct net_device *dev) rcu_read_lock(); idev = rcu_dereference(dev->ip6_ptr); - if (idev) - refcount_inc(&idev->refcnt); + if (idev && !refcount_inc_not_zero(&idev->refcnt)) + idev = NULL; rcu_read_unlock(); return idev; }