Re: [PATCH net v3] ipv4: fix use-after-free in fib_nhc_update_mtu()

[Ido Schimmel]

On Sat, Aug 08, 2026 at 02:17:10AM +0800, Chengfeng Ye wrote:
> fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
> RTNL does not serialize this walk with PMTU exception updates. The walk
> uses rcu_dereference_protected() with a constant true condition without
> holding fnhe_lock.
> 
> The following interleaving can therefore occur:
> 
>   CPU 0                              CPU 1
>   fib_nhc_update_mtu()               update_or_create_fnhe()
>     load fnhe                          spin_lock_bh(&fnhe_lock)
>                                        fnhe_remove_oldest()
>                                          unlink fnhe
>                                          kfree_rcu(fnhe, rcu)
>     <quiescent state>
>     access fnhe after grace period
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
>   Read of size 8 at addr ffff888107d49000 by task poc/90
>   Call Trace:
>    fib_nhc_update_mtu+0x3df/0x410
>    fib_sync_mtu+0x7a/0xd0
>    fib_netdev_event+0x229/0x3f0
>    netif_set_mtu_ext+0x33a/0x570
>    dev_set_mtu+0x88/0x120
> 
> The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a
> pair and other writers serialize them with fnhe_lock. RCU alone prevents
> reclamation, but would still allow concurrent writers to leave a mixed
> pair.
> 
> Walk the table under RCU and acquire fnhe_lock only while updating each
> exception. RCU keeps the current entry alive while the short critical
> section serializes its paired PMTU fields. This avoids holding the global
> lock while scanning all 2048 buckets for every nexthop.
> 
> Fixes: af7d6cce5369 ("net: ipv4: update fnhe_pmtu when first hop's MTU changes")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>