From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f176.google.com (mail-yw1-f176.google.com [209.85.128.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6469C36654C for ; Tue, 18 Aug 2026 16:48:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787071709; cv=none; b=q6hqpdb+pQLpuvU6LZLnnX7t2XqPJBtQ3+c5n9GvoBYcU3S46OAPjEU7mQamPc1mXSLupTj4tzAL/512JyC3vJPCEqJ2yBx16+87clJpFJCFo31vOR2+e53o5EsbTkha0Z80xnKjcyE8NEZWH/UN3HBdGddAjFkspfKln79drT8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787071709; c=relaxed/simple; bh=0Z1kpCviLfqtQ4S1NA1UEO5sU8E2F+Nfc6aC4X7NX5I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U+EKZqb9EEYku21fwUL9PAQwEgRDYFOAVfJkKIPFx75c0TSsG13Bwz9PvYurWrI6u+APJrZzmtMVmPo11KoQH7TiLKVfb5W1thnmTCnRfUXFu3uWYw6dox4ENk5ulnrVjNZmQlBa8gEJqA3+kXQfyr9UWrWyRn42VUcK9IKZI4k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Y1S65EUA; arc=none smtp.client-ip=209.85.128.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y1S65EUA" Received: by mail-yw1-f176.google.com with SMTP id 00721157ae682-836cbcd0a48so1659057b3.1 for ; Tue, 18 Aug 2026 09:48:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787071707; x=1787676507; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JPVXi5wfbRZBRemeKuFfa8ybwBAndyi5M7ZrW09Zovs=; b=Y1S65EUAye9cage/v7ZfPsM0VgatlHjq6cKm3HbtQ22pNJT1wpRuUvsLaoRo+cIVTJ 2ZAARz2cZIBoRJ/n6QkVgZ+Voa0hIKC4Fw8B4X8bx+5zbzEUZEB0lcpvoc+SXKFq46Kk ScvF6D6YrJBIA7McGwtfR0O13IhgVk/fYElBFcgW5GW31mXsAzgHkhjffmtMJWNoWAvC kH13RZZyTLfqyl2yPOiC0B3GApulKqg810rXblHrYE10BSMJVyaraAYGdcjzQwdnDIHW LRlNyKtJU3Qi/MESv/OPthPET+1lXEBifZSxOYGex3Z2yS9dIGD2fLbIH+Ruonbqwmis 2NeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787071707; x=1787676507; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JPVXi5wfbRZBRemeKuFfa8ybwBAndyi5M7ZrW09Zovs=; b=lpGTbPiX50EIb+FablBez0z0PWsNpoOmDVLQVFHkYJGuyNV1gxGyZ7F2/J94Loal8l qw1cQ3Vp8nCz7Xfj2HbQKsAJHELIPtMQIrcc5kIJog4i8OZChAb5J8RICD6dmSjMkKbP zouZxCEazS/QUXWqS6R9AqTwGfphu6QoUtqo6G20BfVzXl2KMBF6mth2P2136Zx/nfMm m/CPy36DYU3A9RQnhWgalQ5Nam5ojh+AmfuOmMGprWv+hQtpRCothQLrMBI69F5yfb1t 8SjAmSw3A64hhdrJPL1MzR/9EedrmhsM1z7XMN9DarNBsQYOEC4WfEOOqP3/2cWzNxGW xP1g== X-Forwarded-Encrypted: i=1; AHgh+RpWI2Mj/Z3ZY7toFK8SRVJZIa0z4KN4T2gKKkIiKsuInwZ4Lm27zr55WwB/jU4bgJaZrUkqQVEs1cCw1ws=@vger.kernel.org X-Gm-Message-State: AOJu0YwZCTwtxAVKJ2GxrQZ5TyjR6hEJFCFvO2jNF+kKlbzgI2tuCA+U eIippXpcsqZ0I/yy8QGBzFplnN2NudYoxdYrlPWYsmNYr1G6cuv9xOwA X-Gm-Gg: AR+sD11R6SQ5oSAUvWK2mDw4CAZ7uvKVGUM3SGMwf9QxBzwvUmjQm+m1/ym1xJ+zTVQ FQ3Q9Wb7l+wbTIo7RknDz5+1EDMfQWSGiDxF2Az8gWOpPeh2HyJxRrc7XUGQ9XsvziZ7Oaqw7Qa 1DBH6bQZFSVJ+GbI92vzeEP1FBS4UMnyzZJlXLwdwmSaASezhlupWSNlasaagybPmidSUV226Uq F6Q4NKuJOUeFue+Q0bn0AcQ+y/YbNaMUff719eG1+cibGw6XJWswKP8e2UYKCHiXLUqYcOItDbF iWOBKPmiCF7sU6fSFqhmD818hOG4+ntRThzC3yQcJA4of9qtil/hriqGp7s9xc4UYsGT17n3ewE bcmfntaypfMCIdheebQWMYczYrZvHTNj9MuORUJ9pF6Kt9q5L3E1VM2cEnl+/2nT78z4u9flkF3 yqpPzv8Nlwktgy7ecY7LcnlbIB29aVp4WwQ8TK+bnUDuNblUVPsfZb8xkf79mMfoESURc= X-Received: by 2002:a05:690c:e1c2:10b0:80c:76fd:f732 with SMTP id 00721157ae682-841316567a4mr29719077b3.26.1787071707289; Tue, 18 Aug 2026 09:48:27 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 00721157ae682-840f25c13f3sm21489317b3.26.2026.08.18.09.48.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 09:48:26 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: ap420073@gmail.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, xmei5@asu.edu, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net] amt: do not store tunnel pointer in skb control block Date: Tue, 18 Aug 2026 12:48:25 -0400 Message-ID: <20260818164825.63967-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, a netem delay of 180s exceeds the default tunnel lifetime of 135s (igmp_qrv=1); when the tunnel expires and is freed, the subsequent dequeue triggers a use-after-free in amt_dev_xmit(). BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20 Call Trace: amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262] dev_hard_start_xmit+0x22f/0x620 sch_direct_xmit+0x12e/0xac0 netem_dequeue+0x333/0xc50 net_tx_action+0x35c/0xa60 Store the tunnel identity (ip4 + source_port) in skb->cb instead of a pointer, and re-lookup the tunnel under RCU in amt_dev_xmit(). If the tunnel is gone, the query is simply dropped. Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Reported-by: AutonomousCodeSecurity@microsoft.com Reported-by: Xiang Mei (Microsoft) Reported-by: Cen Zhang (Microsoft) Signed-off-by: Cen Zhang (Microsoft) --- drivers/net/amt.c | 30 +++++++++++++++++++++++++----- include/net/amt.h | 4 +++- 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/drivers/net/amt.c b/drivers/net/amt.c index 182a41d59a75..a85ba0dfe18a 100644 --- a/drivers/net/amt.c +++ b/drivers/net/amt.c @@ -789,6 +789,18 @@ static void amt_send_request(struct amt_dev *amt, bool v6) rcu_read_unlock(); } +static struct amt_tunnel_list *amt_lookup_tunnel(struct amt_dev *amt, + __be32 ip4, __be16 source_port) +{ + struct amt_tunnel_list *tunnel; + + list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) + if (tunnel->ip4 == ip4 && tunnel->source_port == source_port) + return tunnel; + + return NULL; +} + static void amt_send_igmp_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) { @@ -798,7 +810,8 @@ static void amt_send_igmp_gq(struct amt_dev *amt, if (!skb) return; - amt_skb_cb(skb)->tunnel = tunnel; + amt_skb_cb(skb)->tunnel_ip4 = tunnel->ip4; + amt_skb_cb(skb)->tunnel_port = tunnel->source_port; dev_queue_xmit(skb); } @@ -883,7 +896,8 @@ static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) if (!skb) return; - amt_skb_cb(skb)->tunnel = tunnel; + amt_skb_cb(skb)->tunnel_ip4 = tunnel->ip4; + amt_skb_cb(skb)->tunnel_port = tunnel->source_port; dev_queue_xmit(skb); } #else @@ -1259,15 +1273,21 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev) goto unlock; } else if (amt->mode == AMT_MODE_RELAY) { if (query) { - tunnel = amt_skb_cb(skb)->tunnel; + rcu_read_lock(); + tunnel = amt_lookup_tunnel(amt, + amt_skb_cb(skb)->tunnel_ip4, + amt_skb_cb(skb)->tunnel_port); if (!tunnel) { - WARN_ON(1); + rcu_read_unlock(); goto free; } /* Do not forward unexpected query */ - if (amt_send_membership_query(amt, skb, tunnel, v6)) + if (amt_send_membership_query(amt, skb, tunnel, v6)) { + rcu_read_unlock(); goto free; + } + rcu_read_unlock(); goto unlock; } diff --git a/include/net/amt.h b/include/net/amt.h index a0255491f5b0..59c4bb88fb1e 100644 --- a/include/net/amt.h +++ b/include/net/amt.h @@ -231,8 +231,10 @@ struct amt_relay_headers { }; } __packed; +/* Tunnel identity for re-lookup; do not store a pointer here. */ struct amt_skb_cb { - struct amt_tunnel_list *tunnel; + __be32 tunnel_ip4; + __be16 tunnel_port; }; struct amt_tunnel_list { -- 2.52.0