[PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

[PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

[Eric Dumazet]

IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
When an ingress multicast packet misses MFC lookup,
ip6mr_cache_unresolved() places the skb onto the unresolved queue,
escaping the receive-side RCU grace period.

If the underlying route is deleted and freed, and the MFC queue is later
resolved with a wrong parent interface, ip6_mr_forward() invokes
ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
use-after-free.

Report packets queued to mroute6_sk (a raw socket) and netlink
notifications do not require an attached dst entry.

Fix this by:
1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs
   do not hold a dst.
2. Dropping skb_dst before queuing unresolved skbs in
   ip6mr_cache_unresolved(), matching the fact that multicast
   forwarding resolves outgoing routes anew via ip6_route_output().

Fixes: 67f415dd2906 ("ipv6: convert rx data path to not take refcnt on dst")
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ip6mr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 604a58838901a74712d08505c6bbbdeafd28149c..3f2ed9b77deb51799f34e3826ae271d8d3e2a2dd 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1162,10 +1162,10 @@ static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
 	msg->im6_src = ipv6_hdr(pkt)->saddr;
 	msg->im6_dst = ipv6_hdr(pkt)->daddr;
 
-	skb_dst_set(skb, dst_clone(skb_dst(pkt)));
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
 
+	skb_dst_drop(skb);
 	mrt6msg_netlink_event(mrt, skb);
 
 	/* Deliver to user space multicast routing algorithms */
@@ -1246,6 +1246,7 @@ static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi,
 		skb->skb_iif = dev->ifindex;
 	}
 
+	skb_dst_drop(skb);
 	skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
 
 	spin_unlock_bh(&mfc_unres_lock);
-- 
2.55.0.737.g08866a6d13-goog

Re: [PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

[Hangbin Liu]

On Tue, Aug 18, 2026 at 05:27:55PM +0000, Eric Dumazet wrote:
> IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
> When an ingress multicast packet misses MFC lookup,
> ip6mr_cache_unresolved() places the skb onto the unresolved queue,
> escaping the receive-side RCU grace period.
> 
> If the underlying route is deleted and freed, and the MFC queue is later
> resolved with a wrong parent interface, ip6_mr_forward() invokes
> ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
> dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
> use-after-free.
> 
> Report packets queued to mroute6_sk (a raw socket) and netlink
> notifications do not require an attached dst entry.
> 
> Fix this by:
> 1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs
>    do not hold a dst.
> 2. Dropping skb_dst before queuing unresolved skbs in
>    ip6mr_cache_unresolved(), matching the fact that multicast
>    forwarding resolves outgoing routes anew via ip6_route_output().
> 
> Fixes: 67f415dd2906 ("ipv6: convert rx data path to not take refcnt on dst")
> Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv6/ip6mr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
> index 604a58838901a74712d08505c6bbbdeafd28149c..3f2ed9b77deb51799f34e3826ae271d8d3e2a2dd 100644
> --- a/net/ipv6/ip6mr.c
> +++ b/net/ipv6/ip6mr.c
> @@ -1162,10 +1162,10 @@ static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
>  	msg->im6_src = ipv6_hdr(pkt)->saddr;
>  	msg->im6_dst = ipv6_hdr(pkt)->daddr;
>  
> -	skb_dst_set(skb, dst_clone(skb_dst(pkt)));
>  	skb->ip_summed = CHECKSUM_UNNECESSARY;
>  	}
>  
> +	skb_dst_drop(skb);
>  	mrt6msg_netlink_event(mrt, skb);
>  
>  	/* Deliver to user space multicast routing algorithms */
> @@ -1246,6 +1246,7 @@ static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi,
>  		skb->skb_iif = dev->ifindex;
>  	}
>  
> +	skb_dst_drop(skb);
>  	skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
>  
>  	spin_unlock_bh(&mfc_unres_lock);
> -- 
> 2.55.0.737.g08866a6d13-goog
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 18 Aug 2026 17:27:55 +0000 you wrote:
> IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
> When an ingress multicast packet misses MFC lookup,
> ip6mr_cache_unresolved() places the skb onto the unresolved queue,
> escaping the receive-side RCU grace period.
> 
> If the underlying route is deleted and freed, and the MFC queue is later
> resolved with a wrong parent interface, ip6_mr_forward() invokes
> ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
> dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
> use-after-free.
> 
> [...]

Here is the summary with links:
  - [net] ip6mr: do not clone dst in ip6mr_cache_report()
    https://git.kernel.org/netdev/net/c/235b42b58601

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html