Re: [PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

[Hangbin Liu <hangbin.liu@linux.dev>]

On Tue, Aug 18, 2026 at 05:27:55PM +0000, Eric Dumazet wrote:
> IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
> When an ingress multicast packet misses MFC lookup,
> ip6mr_cache_unresolved() places the skb onto the unresolved queue,
> escaping the receive-side RCU grace period.
> 
> If the underlying route is deleted and freed, and the MFC queue is later
> resolved with a wrong parent interface, ip6_mr_forward() invokes
> ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
> dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
> use-after-free.
> 
> Report packets queued to mroute6_sk (a raw socket) and netlink
> notifications do not require an attached dst entry.
> 
> Fix this by:
> 1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs
>    do not hold a dst.
> 2. Dropping skb_dst before queuing unresolved skbs in
>    ip6mr_cache_unresolved(), matching the fact that multicast
>    forwarding resolves outgoing routes anew via ip6_route_output().
> 
> Fixes: 67f415dd2906 ("ipv6: convert rx data path to not take refcnt on dst")
> Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv6/ip6mr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
> index 604a58838901a74712d08505c6bbbdeafd28149c..3f2ed9b77deb51799f34e3826ae271d8d3e2a2dd 100644
> --- a/net/ipv6/ip6mr.c
> +++ b/net/ipv6/ip6mr.c
> @@ -1162,10 +1162,10 @@ static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
>  	msg->im6_src = ipv6_hdr(pkt)->saddr;
>  	msg->im6_dst = ipv6_hdr(pkt)->daddr;
>  
> -	skb_dst_set(skb, dst_clone(skb_dst(pkt)));
>  	skb->ip_summed = CHECKSUM_UNNECESSARY;
>  	}
>  
> +	skb_dst_drop(skb);
>  	mrt6msg_netlink_event(mrt, skb);
>  
>  	/* Deliver to user space multicast routing algorithms */
> @@ -1246,6 +1246,7 @@ static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi,
>  		skb->skb_iif = dev->ifindex;
>  	}
>  
> +	skb_dst_drop(skb);
>  	skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
>  
>  	spin_unlock_bh(&mfc_unres_lock);
> -- 
> 2.55.0.737.g08866a6d13-goog
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>