[PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Zhou Qiuyue]

rawv6_send_hdrinc() caches the route before handing the skb to
l3mdev_ip6_out(). The VRF output path may replace skb->dst and release
the original route, leaving the cached pointer stale.

The function later dereferences that pointer for statistics accounting
and as the output device passed to NF_HOOK(). Its RCU read-side critical
section starts after l3mdev_ip6_out(), so it cannot prevent the old route
from being reclaimed in between.

Reload the route from the current skb destination after
l3mdev_ip6_out() returns.

KASAN reports a slab-use-after-free in rawv6_sendmsg(), with the route
allocated by ip6_dst_alloc(), freed by dst_destroy() from rcu_core(), and
the related RCU callback queued from vrf_l3_out().

Fixes: 4c1feac58e06 ("net: vrf: Flip IPv6 output path from FIB lookup hook to out hook")
Cc: stable@vger.kernel.org
Signed-off-by: Zhou Qiuyue <n0ps1edzz@gmail.com>
---
Changes in v2:
- Rebased onto the current net tree at 7076f684d513.
- Regenerated the patch with git-format-patch so it applies cleanly.
- Corrected the Fixes tag to the commit that made the IPv6 VRF path reachable.
- Shortened the code comment and added the required recipients.

v1: https://lore.kernel.org/r/6adad51d.8fc0b0c9.1ec657.1868@mx.google.com

Thank you to Hangbin Liu for reviewing v1 and pointing out the submission
issues.

 net/ipv6/raw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index b965258cf..bdea82543 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
 	if (unlikely(!skb))
 		return 0;
 
+	/* l3mdev_ip6_out() may have replaced the skb dst. */
+	rt = dst_rt6_info(skb_dst(skb));
+
 	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
 	 * in the error path. Since skb has been freed, the dst could
 	 * have been queued for deletion.

base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
-- 
2.50.1.windows.1

Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Hangbin Liu]

On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> rawv6_send_hdrinc() caches the route before handing the skb to
> l3mdev_ip6_out(). The VRF output path may replace skb->dst and release
> the original route, leaving the cached pointer stale.
> 
> The function later dereferences that pointer for statistics accounting
> and as the output device passed to NF_HOOK(). Its RCU read-side critical
> section starts after l3mdev_ip6_out(), so it cannot prevent the old route
> from being reclaimed in between.
> 
> Reload the route from the current skb destination after
> l3mdev_ip6_out() returns.
> 
> KASAN reports a slab-use-after-free in rawv6_sendmsg(), with the route
> allocated by ip6_dst_alloc(), freed by dst_destroy() from rcu_core(), and
> the related RCU callback queued from vrf_l3_out().
> 
> Fixes: 4c1feac58e06 ("net: vrf: Flip IPv6 output path from FIB lookup hook to out hook")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhou Qiuyue <n0ps1edzz@gmail.com>
> ---
> Changes in v2:
> - Rebased onto the current net tree at 7076f684d513.
> - Regenerated the patch with git-format-patch so it applies cleanly.
> - Corrected the Fixes tag to the commit that made the IPv6 VRF path reachable.
> - Shortened the code comment and added the required recipients.
> 
> v1: https://lore.kernel.org/r/6adad51d.8fc0b0c9.1ec657.1868@mx.google.com
> 
> Thank you to Hangbin Liu for reviewing v1 and pointing out the submission
> issues.
> 
>  net/ipv6/raw.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> index b965258cf..bdea82543 100644
> --- a/net/ipv6/raw.c
> +++ b/net/ipv6/raw.c
> @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
>  	if (unlikely(!skb))
>  		return 0;
>  
> +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> +	rt = dst_rt6_info(skb_dst(skb));
> +
>  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
>  	 * in the error path. Since skb has been freed, the dst could
>  	 * have been queued for deletion.
> 
> base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
> -- 
> 2.50.1.windows.1
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Antoine Tenart]

On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > index b965258cf..bdea82543 100644
> > --- a/net/ipv6/raw.c
> > +++ b/net/ipv6/raw.c
> > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> >  	if (unlikely(!skb))
> >  		return 0;
> >  
> > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > +	rt = dst_rt6_info(skb_dst(skb));
> > +
> >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> >  	 * in the error path. Since skb has been freed, the dst could
> >  	 * have been queued for deletion.
> 
> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

Doesn't this change the device seen by the nf hook / used for the stats?

Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Hangbin Liu]

On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
> On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> > On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > > index b965258cf..bdea82543 100644
> > > --- a/net/ipv6/raw.c
> > > +++ b/net/ipv6/raw.c
> > > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> > >  	if (unlikely(!skb))
> > >  		return 0;
> > >  
> > > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > > +	rt = dst_rt6_info(skb_dst(skb));
> > > +
> > >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> > >  	 * in the error path. Since skb has been freed, the dst could
> > >  	 * have been queued for deletion.
> > 
> > Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> Doesn't this change the device seen by the nf hook / used for the stats?

Should we still use the old/released rt->dst.dev after the VRF output
path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
use vrf device.

Thanks
Hangbin

Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Antoine Tenart]

On Tue, Oct 27, 2026 at 09:38:34AM +0800, Hangbin Liu wrote:
> On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
> > On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> > > On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > > > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > > > index b965258cf..bdea82543 100644
> > > > --- a/net/ipv6/raw.c
> > > > +++ b/net/ipv6/raw.c
> > > > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> > > >  	if (unlikely(!skb))
> > > >  		return 0;
> > > >  
> > > > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > > > +	rt = dst_rt6_info(skb_dst(skb));
> > > > +
> > > >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> > > >  	 * in the error path. Since skb has been freed, the dst could
> > > >  	 * have been queued for deletion.
> > > 
> > > Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
> > 
> > Doesn't this change the device seen by the nf hook / used for the stats?
> 
> Should we still use the old/released rt->dst.dev after the VRF output
> path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
> use vrf device.

Right, but then in the direct path the NF_INET_LOCAL_OUT hook would be
run twice with the same dev. Looking at other call sites for
l3mdev_ip6_out, it's not clear either,  __ip6_local_out reloads the dev
while ip6_xmit does not. I'm not sure what is the expected behavior.

Regardless of that, the change in behavior (if right) would be worth
mentioning in the commit log.