Re: [PATCH net] amt: refresh cached IP header pointers after MLD/IGMP checks

[Xiang Mei]

Thanks for the reminder.

Xiang

On Tue, Jul 14, 2026 at 6:16 AM Taehee Yoo <ap420073@xxxxxxxxx> wrote:
>
> On Fri, Jul 10, 2026 at 10:41 AM Xiang Mei (Microsoft) <xmei5@xxxxxxx> wrote:
> >
>
> Hi Xiang Mei,
> Sorry for the late reply.
>
> > amt_dev_xmit() and amt_update_handler() cache iph/ip6h before calling
> > ip_mc_check_igmp() / ipv6_mc_check_mld(), which may pskb_may_pull() a
> > non-linear skb and reallocate skb->head. The stale pointers are then
> > read (amt_dev_xmit: group.ip{4,6} = iph/ip6h->daddr; amt_update_handler:
> > ip{,v6}_eth_mc_map()), a slab-use-after-free. tx is reachable by an
> > unprivileged user whose amt device has SG enabled; rx by a tunnel peer
> > sending a membership update fragmented across several IP fragments.
> >
> > Reload iph/ip6h after the check returns, like commit f0e42f0c4337
> > ("ipv6: sit: reload inner IPv6 header after GSO offloads").
> >
> > tx path:
> >   BUG: KASAN: slab-use-after-free in amt_dev_xmit (drivers/net/amt.c:1238)
> >   Read of size 16 by task exploit
> >    amt_dev_xmit (drivers/net/amt.c:1238)
> >    dev_hard_start_xmit (net/core/dev.c:3905)
> >    __dev_queue_xmit (net/core/dev.c:4872)
> >    packet_sendmsg (net/packet/af_packet.c:3114)
> >
> > rx path:
> >   BUG: KASAN: slab-use-after-free in amt_rcv (drivers/net/amt.c:2530)
> >   Read of size 4 by task exploit
> >    amt_rcv (drivers/net/amt.c:2530)
> >    udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
> >    ip_local_deliver (net/ipv4/ip_input.c:262)
> >    ip_rcv (net/ipv4/ip_input.c:612)
> >
> > Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> > Fixes: bc54e49c140b ("amt: add multicast(IGMP) report message handler")
> > Fixes: b75f7095d4d4 ("amt: add mld report message handler")
> > Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
> > Signed-off-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
>
> Thanks a lot for this work.
> However Michael Bommarito is already working on this.
> https://lore.kernel.org/netdev/20260711151934.2955226-2-michael.bommarito@xxxxxxxxx/
>
> Thanks,
> Taehee Yoo
>
> > ---
> >  drivers/net/amt.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> > index 951dd10e192b..8bc61c539b0a 100644
> > --- a/drivers/net/amt.c
> > +++ b/drivers/net/amt.c
> > @@ -1210,6 +1210,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> >                 } else {
> >                         data = true;
> >                 }
> > +               iph = ip_hdr(skb);
> >                 v6 = false;
> >                 group.ip4 = iph->daddr;
> >  #if IS_ENABLED(CONFIG_IPV6)
> > @@ -1234,6 +1235,7 @@ static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev)
> >                 } else {
> >                         data = true;
> >                 }
> > +               ip6h = ipv6_hdr(skb);
> >                 v6 = true;
> >                 group.ip6 = ip6h->daddr;
> >  #endif
> > @@ -2498,6 +2500,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
> >                         netdev_dbg(amt->dev, "Invalid IGMP\n");
> >                         return true;
> >                 }
> > +               iph = ip_hdr(skb);
> >
> >                 spin_lock_bh(&tunnel->lock);
> >                 amt_igmp_report_handler(amt, skb, tunnel);
> > @@ -2517,6 +2520,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
> >                         netdev_dbg(amt->dev, "Invalid MLD\n");
> >                         return true;
> >                 }
> > +               ip6h = ipv6_hdr(skb);
> >
> >                 spin_lock_bh(&tunnel->lock);
> >                 amt_mld_report_handler(amt, skb, tunnel);
> > --
> > 2.43.0
> >