Re: [PATCH net] amt: linearize skb in amt_rcv() to fix use-after-free of cached headers

[Xiang Mei]

On Tue, Jul 21, 2026 at 5:10 PM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
> On Wed, Jul 22, 2026 at 1:28 AM Xiang Mei (Microsoft) <xmei5@xxxxxxx> wrote:
> >
> > The AMT message handlers cache pointers into the skb linear area (grec,
> > iph, ip6h, eth) and keep using them across ip_mc_may_pull() /
> > pskb_may_pull(). On a non-linear skb (e.g. a reassembled fragmented AMT
> > membership update) such a pull can reallocate skb->head via
> > pskb_expand_head(), leaving those pointers dangling into freed memory.
> >
> > Linearize the skb on entry to amt_rcv() so no later pull reallocates the
> > head. This is a no-op for the common linear skb, and covers all handlers
> > at once. Drop the packet if linearization fails.
> >
> >   BUG: KASAN: slab-use-after-free in amt_igmpv3_report_handler (drivers/net/amt.c:2023)
> >   Read of size 4 at addr ffff888013fdd71c by task exploit
> >   Call Trace:
> >    <IRQ>
> >    amt_igmpv3_report_handler (drivers/net/amt.c:2023)
> >    amt_update_handler (drivers/net/amt.c:2503)
> >    amt_rcv (drivers/net/amt.c:2846)
> >    udp_queue_rcv_one_skb (net/ipv4/udp.c:2389)
> >    udp_unicast_rcv_skb (net/ipv4/udp.c:2580)
> >    ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
> >    ip_local_deliver_finish (net/ipv4/ip_input.c:242)
> >    ip_local_deliver (net/ipv4/ip_input.c:262)
> >    ip_rcv (net/ipv4/ip_input.c:612)
> >    __netif_receive_skb_one_core (net/core/dev.c:6212)
> >
> > Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> > Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
> > Signed-off-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
> > ---
> >  drivers/net/amt.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> > index 951dd10e192b..2bce99d45d2c 100644
> > --- a/drivers/net/amt.c
> > +++ b/drivers/net/amt.c
> > @@ -2785,6 +2785,10 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
> >         }
> >
> >         skb->dev = amt->dev;
> > +       if (skb_linearize(skb)) {
> > +               err = true;
> > +               goto drop;
> > +       }
> >         iph = ip_hdr(skb);
> >         type = amt_parse_type(skb);
> >         if (type == -1) {
> > --
> > 2.43.0
> >
>
> You are essentially killing the performance and usability of this module.
>
> pw-bot: cr

Thanks for your review. I focus too much on a small and elegant patch,
ignoring the functionality, Lol.
I'll revise after understanding the performance concerns.

Xiang