Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[David Ahern]

On 10/27/26 7:27 PM, Hangbin Liu wrote:
> On Tue, Oct 27, 2026 at 10:43:48AM +0100, Antoine Tenart wrote:
>> On Tue, Oct 27, 2026 at 09:38:34AM +0800, Hangbin Liu wrote:
>>> On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
>>>> On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
>>>>> On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
>>>>>> diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
>>>>>> index b965258cf..bdea82543 100644
>>>>>> --- a/net/ipv6/raw.c
>>>>>> +++ b/net/ipv6/raw.c
>>>>>> @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
>>>>>>  	if (unlikely(!skb))
>>>>>>  		return 0;
>>>>>>  
>>>>>> +	/* l3mdev_ip6_out() may have replaced the skb dst. */
>>>>>> +	rt = dst_rt6_info(skb_dst(skb));
>>>>>> +
>>>>>>  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
>>>>>>  	 * in the error path. Since skb has been freed, the dst could
>>>>>>  	 * have been queued for deletion.
>>>>>
>>>>> Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
>>>>
>>>> Doesn't this change the device seen by the nf hook / used for the stats?
>>>
>>> Should we still use the old/released rt->dst.dev after the VRF output
>>> path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
>>> use vrf device.
>>
>> Right, but then in the direct path the NF_INET_LOCAL_OUT hook would be
>> run twice with the same dev. Looking at other call sites for
>> l3mdev_ip6_out, it's not clear either,  __ip6_local_out reloads the dev
>> while ip6_xmit does not. I'm not sure what is the expected behavior.
> 
> Hmm, me neither. David might know.
> 

I do not recall the original behavior; that was many years ago.