Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Hangbin Liu]

On Tue, Oct 27, 2026 at 10:43:48AM +0100, Antoine Tenart wrote:
> On Tue, Oct 27, 2026 at 09:38:34AM +0800, Hangbin Liu wrote:
> > On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
> > > On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> > > > On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > > > > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > > > > index b965258cf..bdea82543 100644
> > > > > --- a/net/ipv6/raw.c
> > > > > +++ b/net/ipv6/raw.c
> > > > > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> > > > >  	if (unlikely(!skb))
> > > > >  		return 0;
> > > > >  
> > > > > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > > > > +	rt = dst_rt6_info(skb_dst(skb));
> > > > > +
> > > > >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> > > > >  	 * in the error path. Since skb has been freed, the dst could
> > > > >  	 * have been queued for deletion.
> > > > 
> > > > Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> > > 
> > > Doesn't this change the device seen by the nf hook / used for the stats?
> > 
> > Should we still use the old/released rt->dst.dev after the VRF output
> > path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
> > use vrf device.
> 
> Right, but then in the direct path the NF_INET_LOCAL_OUT hook would be
> run twice with the same dev. Looking at other call sites for
> l3mdev_ip6_out, it's not clear either,  __ip6_local_out reloads the dev
> while ip6_xmit does not. I'm not sure what is the expected behavior.

Hmm, me neither. David might know.

Thanks
Hangbin
> 
> Regardless of that, the change in behavior (if right) would be worth
> mentioning in the commit log.