Re: [PATCH net] amt: refresh cached IP header pointers after MLD/IGMP checks

[Taehee Yoo]

On Fri, Jul 10, 2026 at 10:41 AM Xiang Mei (Microsoft) <xmei5@xxxxxxx> wrote:
>

Hi Xiang Mei,
Sorry for the late reply.

> amt_dev_xmit() and amt_update_handler() cache iph/ip6h before calling
> ip_mc_check_igmp() / ipv6_mc_check_mld(), which may pskb_may_pull() a
> non-linear skb and reallocate skb->head. The stale pointers are then
> read (amt_dev_xmit: group.ip{4,6} = iph/ip6h->daddr; amt_update_handler:
> ip{,v6}_eth_mc_map()), a slab-use-after-free. tx is reachable by an
> unprivileged user whose amt device has SG enabled; rx by a tunnel peer
> sending a membership update fragmented across several IP fragments.
>
> Reload iph/ip6h after the check returns, like commit f0e42f0c4337
> ("ipv6: sit: reload inner IPv6 header after GSO offloads").
>
> tx path:
>   BUG: KASAN: slab-use-after-free in amt_dev_xmit (drivers/net/amt.c:1238)
>   Read of size 16 by task exploit
>    amt_dev_xmit (drivers/net/amt.c:1238)
>    dev_hard_start_xmit (net/core/dev.c:3905)
>    __dev_queue_xmit (net/core/dev.c:4872)
>    packet_sendmsg (net/packet/af_packet.c:3114)
>
> rx path:
>   BUG: KASAN: slab-use-after-free in amt_rcv (drivers/net/amt.c:2530)
>   Read of size 4 by task exploit
>    amt_rcv (drivers/net/amt.c:2530)
>    udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
>    ip_local_deliver (net/ipv4/ip_input.c:262)
>    ip_rcv (net/ipv4/ip_input.c:612)
>
> Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> Fixes: bc54e49c140b ("amt: add multicast(IGMP) report message handler")
> Fixes: b75f7095d4d4 ("amt: add mld report message handler")
> Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>

Thanks a lot for this work.
However Michael Bommarito is already working on this.
https://lore.kernel.org/netdev/20260711151934.2955226-2-michael.bommarito@xxxxxxxxx/

Thanks,
Taehee Yoo

> ---
>  drivers/net/amt.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> index 951dd10e192b..8bc61c539b0a 100644
> --- a/drivers/net/amt.c
> +++ b/drivers/net/amt.c
> @@ -1210,6 +1210,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
>                 } else {
>                         data = true;
>                 }
> +               iph = ip_hdr(skb);
>                 v6 = false;
>                 group.ip4 = iph->daddr;
>  #if IS_ENABLED(CONFIG_IPV6)
> @@ -1234,6 +1235,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
>                 } else {
>                         data = true;
>                 }
> +               ip6h = ipv6_hdr(skb);
>                 v6 = true;
>                 group.ip6 = ip6h->daddr;
>  #endif
> @@ -2498,6 +2500,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
>                         netdev_dbg(amt->dev, "Invalid IGMP\n");
>                         return true;
>                 }
> +               iph = ip_hdr(skb);
>
>                 spin_lock_bh(&tunnel->lock);
>                 amt_igmp_report_handler(amt, skb, tunnel);
> @@ -2517,6 +2520,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
>                         netdev_dbg(amt->dev, "Invalid MLD\n");
>                         return true;
>                 }
> +               ip6h = ipv6_hdr(skb);
>
>                 spin_lock_bh(&tunnel->lock);
>                 amt_mld_report_handler(amt, skb, tunnel);
> --
> 2.43.0
>