* [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
@ 2026-03-07 3:51 xietangxin
2026-03-07 4:15 ` Eric Dumazet
2026-03-09 3:42 ` Jason Wang
0 siblings, 2 replies; 6+ messages in thread
From: xietangxin @ 2026-03-07 3:51 UTC (permalink / raw)
To: Michael S . Tsirkin, Jason Wang, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Andrew Lunn, Xuan Zhuo,
Eugenio Pérez
Cc: netdev, virtualization, linux-kernel, xietangxin
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit() is triggered to clean up old skbs.
It then calls dst_release() on the skb associated with the stale dst_entry.
Since the dst_ops (referenced by the dst_entry) has already been freed,
a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
the dst reference before the skb is queued in virtio_net.
Call Trace:
Unable to handle kernel paging request at virtual address ffff80007e150000
CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
...
percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
dst_release+0xe0/0x110 net/core/dst.c:177
skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
__free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2
test_ns
Signed-off-by: xietangxin <xietangxin@yeah.net>
---
drivers/net/virtio_net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 72d6a9c6a..5b13a61b3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3351,6 +3351,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
/* Don't wait up for transmitted skbs to be freed. */
if (!use_napi) {
skb_orphan(skb);
+ skb_dst_drop(skb);
nf_reset_ct(skb);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-03-07 3:51 [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false xietangxin
@ 2026-03-07 4:15 ` Eric Dumazet
2026-03-10 6:36 ` xietangxin
2026-03-09 3:42 ` Jason Wang
1 sibling, 1 reply; 6+ messages in thread
From: Eric Dumazet @ 2026-03-07 4:15 UTC (permalink / raw)
To: xietangxin
Cc: Michael S . Tsirkin, Jason Wang, David S . Miller, Jakub Kicinski,
Paolo Abeni, Andrew Lunn, Xuan Zhuo, Eugenio Pérez, netdev,
virtualization, linux-kernel
On Sat, Mar 7, 2026 at 4:52 AM xietangxin <xietangxin@yeah.net> wrote:
>
> A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
> and the device's IFF_XMIT_DST_RELEASE flag is cleared
> (e.g., during the configuration of tc route filter rules).
>
> When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
> expects the driver to hold the reference to skb->dst until the packet
> is fully transmitted and freed. In virtio_net with napi_tx=N,
> skbs may remain in the virtio transmit ring for an extended period.
>
> If the network namespace is destroyed while these skbs are still pending,
> the corresponding dst_ops structure has freed. When a subsequent packet
> is transmitted, free_old_xmit() is triggered to clean up old skbs.
> It then calls dst_release() on the skb associated with the stale dst_entry.
> Since the dst_ops (referenced by the dst_entry) has already been freed,
> a UAF kernel paging request occurs.
>
> fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
> the dst reference before the skb is queued in virtio_net.
>
> Call Trace:
> Unable to handle kernel paging request at virtual address ffff80007e150000
> CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
> ...
> percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
> dst_release+0xe0/0x110 net/core/dst.c:177
> skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
> sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
> dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
> napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
> __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
> free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
> start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
> ...
>
> Reproduction Steps:
> NETDEV="enp3s0"
>
> config_qdisc_route_filter() {
> tc qdisc del dev $NETDEV root
> tc qdisc add dev $NETDEV root handle 1: prio
> tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
> ip route add 192.168.1.100/32 dev $NETDEV realm 100
> }
>
> test_ns() {
> ip netns add testns
> ip link set $NETDEV netns testns
> ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
> ip netns exec testns ping -c 1 10.0.32.1
> ip netns del testns
> }
>
> config_qdisc_route_filter
>
> test_ns
> sleep 2
> test_ns
>
> Signed-off-by: xietangxin <xietangxin@yeah.net>
> ---
> drivers/net/virtio_net.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 72d6a9c6a..5b13a61b3 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -3351,6 +3351,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
> /* Don't wait up for transmitted skbs to be freed. */
> if (!use_napi) {
> skb_orphan(skb);
> + skb_dst_drop(skb);
> nf_reset_ct(skb);
> }
This probably could skb_release_head_state() at this point.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-03-07 3:51 [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false xietangxin
2026-03-07 4:15 ` Eric Dumazet
@ 2026-03-09 3:42 ` Jason Wang
2026-03-09 11:35 ` xietangxin
1 sibling, 1 reply; 6+ messages in thread
From: Jason Wang @ 2026-03-09 3:42 UTC (permalink / raw)
To: xietangxin
Cc: Michael S . Tsirkin, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Andrew Lunn, Xuan Zhuo,
Eugenio Pérez, netdev, virtualization, linux-kernel
On Sat, Mar 7, 2026 at 11:53 AM xietangxin <xietangxin@yeah.net> wrote:
>
> A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
> and the device's IFF_XMIT_DST_RELEASE flag is cleared
> (e.g., during the configuration of tc route filter rules).
>
> When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
> expects the driver to hold the reference to skb->dst until the packet
> is fully transmitted and freed. In virtio_net with napi_tx=N,
> skbs may remain in the virtio transmit ring for an extended period.
>
> If the network namespace is destroyed while these skbs are still pending,
> the corresponding dst_ops structure has freed. When a subsequent packet
> is transmitted, free_old_xmit() is triggered to clean up old skbs.
> It then calls dst_release() on the skb associated with the stale dst_entry.
> Since the dst_ops (referenced by the dst_entry) has already been freed,
> a UAF kernel paging request occurs.
>
> fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
> the dst reference before the skb is queued in virtio_net.
>
> Call Trace:
> Unable to handle kernel paging request at virtual address ffff80007e150000
> CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
> ...
> percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
> dst_release+0xe0/0x110 net/core/dst.c:177
> skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
> sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
> dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
> napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
> __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
> free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
> start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
> ...
>
> Reproduction Steps:
> NETDEV="enp3s0"
>
> config_qdisc_route_filter() {
> tc qdisc del dev $NETDEV root
> tc qdisc add dev $NETDEV root handle 1: prio
> tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
> ip route add 192.168.1.100/32 dev $NETDEV realm 100
> }
>
> test_ns() {
> ip netns add testns
> ip link set $NETDEV netns testns
> ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
> ip netns exec testns ping -c 1 10.0.32.1
> ip netns del testns
> }
>
> config_qdisc_route_filter
>
> test_ns
> sleep 2
> test_ns
>
> Signed-off-by: xietangxin <xietangxin@yeah.net>
> ---
This is needed for stable I think.
And do we need to fix tun_net_xmit() as well?
Thanks
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-03-09 3:42 ` Jason Wang
@ 2026-03-09 11:35 ` xietangxin
2026-03-10 3:02 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: xietangxin @ 2026-03-09 11:35 UTC (permalink / raw)
To: Jason Wang
Cc: Michael S . Tsirkin, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Andrew Lunn, Xuan Zhuo,
Eugenio Pérez, netdev, virtualization, linux-kernel
On 3/9/2026 11:42 AM, Jason Wang wrote:
> On Sat, Mar 7, 2026 at 11:53 AM xietangxin <xietangxin@yeah.net> wrote:
>>
>> A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
>> and the device's IFF_XMIT_DST_RELEASE flag is cleared
>> (e.g., during the configuration of tc route filter rules).
>>
>> When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
>> expects the driver to hold the reference to skb->dst until the packet
>> is fully transmitted and freed. In virtio_net with napi_tx=N,
>> skbs may remain in the virtio transmit ring for an extended period.
>>
>> If the network namespace is destroyed while these skbs are still pending,
>> the corresponding dst_ops structure has freed. When a subsequent packet
>> is transmitted, free_old_xmit() is triggered to clean up old skbs.
>> It then calls dst_release() on the skb associated with the stale dst_entry.
>> Since the dst_ops (referenced by the dst_entry) has already been freed,
>> a UAF kernel paging request occurs.
>>
>> fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
>> the dst reference before the skb is queued in virtio_net.
>>
>> Call Trace:
>> Unable to handle kernel paging request at virtual address ffff80007e150000
>> CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
>> ...
>> percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
>> dst_release+0xe0/0x110 net/core/dst.c:177
>> skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
>> sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
>> dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
>> napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
>> __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
>> free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
>> start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
>> ...
>>
>> Reproduction Steps:
>> NETDEV="enp3s0"
>>
>> config_qdisc_route_filter() {
>> tc qdisc del dev $NETDEV root
>> tc qdisc add dev $NETDEV root handle 1: prio
>> tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
>> ip route add 192.168.1.100/32 dev $NETDEV realm 100
>> }
>>
>> test_ns() {
>> ip netns add testns
>> ip link set $NETDEV netns testns
>> ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
>> ip netns exec testns ping -c 1 10.0.32.1
>> ip netns del testns
>> }
>>
>> config_qdisc_route_filter
>>
>> test_ns
>> sleep 2
>> test_ns
>>
>> Signed-off-by: xietangxin <xietangxin@yeah.net>
>> ---
>
> This is needed for stable I think.
>
> And do we need to fix tun_net_xmit() as well?
>
> Thanks
Hi Jason,
I have analyzed the tun driver and concluded that it don't suffer from this UAF issue.
The netns containing a tun interface cannot be destroyed until all processes
holding the tun file descriptor have exited. When the file descriptor is closed,
tun_chr_close() is called, which immediately free all skbs in the tx_ring.
This happens before cleanup_net() destroys the dst_ops. Therefore, no skbs referencing freeed dst_ops.
Unlike virtio_net, where skbs can remain in the TX queue even if the ns is deleted.
I believe the fix is only necessary for virtio_net. What do you think?
Best regards,
Tangxin Xie
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-03-09 11:35 ` xietangxin
@ 2026-03-10 3:02 ` Jason Wang
0 siblings, 0 replies; 6+ messages in thread
From: Jason Wang @ 2026-03-10 3:02 UTC (permalink / raw)
To: xietangxin
Cc: Michael S . Tsirkin, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Andrew Lunn, Xuan Zhuo,
Eugenio Pérez, netdev, virtualization, linux-kernel
On Mon, Mar 9, 2026 at 7:37 PM xietangxin <xietangxin@yeah.net> wrote:
>
>
>
> On 3/9/2026 11:42 AM, Jason Wang wrote:
> > On Sat, Mar 7, 2026 at 11:53 AM xietangxin <xietangxin@yeah.net> wrote:
> >>
> >> A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
> >> and the device's IFF_XMIT_DST_RELEASE flag is cleared
> >> (e.g., during the configuration of tc route filter rules).
> >>
> >> When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
> >> expects the driver to hold the reference to skb->dst until the packet
> >> is fully transmitted and freed. In virtio_net with napi_tx=N,
> >> skbs may remain in the virtio transmit ring for an extended period.
> >>
> >> If the network namespace is destroyed while these skbs are still pending,
> >> the corresponding dst_ops structure has freed. When a subsequent packet
> >> is transmitted, free_old_xmit() is triggered to clean up old skbs.
> >> It then calls dst_release() on the skb associated with the stale dst_entry.
> >> Since the dst_ops (referenced by the dst_entry) has already been freed,
> >> a UAF kernel paging request occurs.
> >>
> >> fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
> >> the dst reference before the skb is queued in virtio_net.
> >>
> >> Call Trace:
> >> Unable to handle kernel paging request at virtual address ffff80007e150000
> >> CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
> >> ...
> >> percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
> >> dst_release+0xe0/0x110 net/core/dst.c:177
> >> skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
> >> sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
> >> dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
> >> napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
> >> __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
> >> free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
> >> start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
> >> ...
> >>
> >> Reproduction Steps:
> >> NETDEV="enp3s0"
> >>
> >> config_qdisc_route_filter() {
> >> tc qdisc del dev $NETDEV root
> >> tc qdisc add dev $NETDEV root handle 1: prio
> >> tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
> >> ip route add 192.168.1.100/32 dev $NETDEV realm 100
> >> }
> >>
> >> test_ns() {
> >> ip netns add testns
> >> ip link set $NETDEV netns testns
> >> ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
> >> ip netns exec testns ping -c 1 10.0.32.1
> >> ip netns del testns
> >> }
> >>
> >> config_qdisc_route_filter
> >>
> >> test_ns
> >> sleep 2
> >> test_ns
> >>
> >> Signed-off-by: xietangxin <xietangxin@yeah.net>
> >> ---
> >
> > This is needed for stable I think.
> >
> > And do we need to fix tun_net_xmit() as well?
> >
> > Thanks
> Hi Jason,
>
> I have analyzed the tun driver and concluded that it don't suffer from this UAF issue.
>
> The netns containing a tun interface cannot be destroyed until all processes
> holding the tun file descriptor have exited.
Note that you can close all the file descriptors but tun device is still there.
> When the file descriptor is closed,
> tun_chr_close() is called, which immediately free all skbs in the tx_ring.
> This happens before cleanup_net() destroys the dst_ops. Therefore, no skbs referencing freeed dst_ops.
> Unlike virtio_net, where skbs can remain in the TX queue even if the ns is deleted.
>
> I believe the fix is only necessary for virtio_net. What do you think?
>
> Best regards,
>
> Tangxin Xie
>
Thanks
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
2026-03-07 4:15 ` Eric Dumazet
@ 2026-03-10 6:36 ` xietangxin
0 siblings, 0 replies; 6+ messages in thread
From: xietangxin @ 2026-03-10 6:36 UTC (permalink / raw)
To: Eric Dumazet
Cc: Michael S . Tsirkin, Jason Wang, David S . Miller, Jakub Kicinski,
Paolo Abeni, Andrew Lunn, Xuan Zhuo, Eugenio Pérez, netdev,
virtualization, linux-kernel
On 3/7/2026 12:15 PM, Eric Dumazet wrote:
> On Sat, Mar 7, 2026 at 4:52 AM xietangxin <xietangxin@yeah.net> wrote:
>>
>> A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
>> and the device's IFF_XMIT_DST_RELEASE flag is cleared
>> (e.g., during the configuration of tc route filter rules).
>>
>> When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
>> expects the driver to hold the reference to skb->dst until the packet
>> is fully transmitted and freed. In virtio_net with napi_tx=N,
>> skbs may remain in the virtio transmit ring for an extended period.
>>
>> If the network namespace is destroyed while these skbs are still pending,
>> the corresponding dst_ops structure has freed. When a subsequent packet
>> is transmitted, free_old_xmit() is triggered to clean up old skbs.
>> It then calls dst_release() on the skb associated with the stale dst_entry.
>> Since the dst_ops (referenced by the dst_entry) has already been freed,
>> a UAF kernel paging request occurs.
>>
>> fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
>> the dst reference before the skb is queued in virtio_net.
>>
>> Call Trace:
>> Unable to handle kernel paging request at virtual address ffff80007e150000
>> CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
>> ...
>> percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
>> dst_release+0xe0/0x110 net/core/dst.c:177
>> skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
>> sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
>> dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
>> napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
>> __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
>> free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
>> start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
>> ...
>>
>> Reproduction Steps:
>> NETDEV="enp3s0"
>>
>> config_qdisc_route_filter() {
>> tc qdisc del dev $NETDEV root
>> tc qdisc add dev $NETDEV root handle 1: prio
>> tc filter add dev $NETDEV parent 1:0 protocol ip prio 100 route to 100 flowid 1:1
>> ip route add 192.168.1.100/32 dev $NETDEV realm 100
>> }
>>
>> test_ns() {
>> ip netns add testns
>> ip link set $NETDEV netns testns
>> ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
>> ip netns exec testns ping -c 1 10.0.32.1
>> ip netns del testns
>> }
>>
>> config_qdisc_route_filter
>>
>> test_ns
>> sleep 2
>> test_ns
>>
>> Signed-off-by: xietangxin <xietangxin@yeah.net>
>> ---
>> drivers/net/virtio_net.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
>> index 72d6a9c6a..5b13a61b3 100644
>> --- a/drivers/net/virtio_net.c
>> +++ b/drivers/net/virtio_net.c
>> @@ -3351,6 +3351,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
>> /* Don't wait up for transmitted skbs to be freed. */
>> if (!use_napi) {
>> skb_orphan(skb);
>> + skb_dst_drop(skb);
>> nf_reset_ct(skb);
>> }
>
> This probably could skb_release_head_state() at this point.
>
> Thanks.
Hi Eric,
Thanks for the suggestion.
I have verified that calling skb_release_head_state() in the virtio_net
does indeed fix the UAF issue.
However, skb_release_head_state() is currently a non-exported symbol.
Since virtio_net can be built as a module, using it would require exporting.
Given that this issue currently only affects virtio_net,
I am concerned whether exporting such a core internal function is appropriate.
Best regards,
Tangxin Xie
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-03-10 6:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-07 3:51 [PATCH] virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false xietangxin
2026-03-07 4:15 ` Eric Dumazet
2026-03-10 6:36 ` xietangxin
2026-03-09 3:42 ` Jason Wang
2026-03-09 11:35 ` xietangxin
2026-03-10 3:02 ` Jason Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox