Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Hangbin Liu]

On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
> On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> > On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > > index b965258cf..bdea82543 100644
> > > --- a/net/ipv6/raw.c
> > > +++ b/net/ipv6/raw.c
> > > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> > >  	if (unlikely(!skb))
> > >  		return 0;
> > >  
> > > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > > +	rt = dst_rt6_info(skb_dst(skb));
> > > +
> > >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> > >  	 * in the error path. Since skb has been freed, the dst could
> > >  	 * have been queued for deletion.
> > 
> > Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> 
> Doesn't this change the device seen by the nf hook / used for the stats?

Should we still use the old/released rt->dst.dev after the VRF output
path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
use vrf device.

Thanks
Hangbin