Re: [PATCH net] ipv4: Fix device use-after-free in ip_skb_dst_mtu()

[Chengfeng Ye]

On Mon, Sep 28, 2026 at 8:34 PM Ido Schimmel <idosch@xxxxxxxxxx> wrote:
>
> On Sun, Sep 27, 2026 at 03:10:51PM +0800, Chengfeng Ye wrote:
> > When a socket ignores the path MTU, ip_skb_dst_mtu() reads the device
> > MTU without RCU protection. The multicast and broadcast output path
> > through ip_mc_output() can reach this helper without an RCU read lock.
> > Netfilter releases its internal read lock before calling
> > ip_finish_output().
> >
> > A sender can load dst->dev and then be preempted before reading dev->mtu.
> > Concurrent device unregistration replaces dst->dev with blackhole_netdev
> > and drops the old device reference. After the grace period and remaining
> > references drain, the device can be freed before the sender resumes and
> > reads its MTU, causing a use-after-free.
> >
> > KASAN reported:
> >
> >   BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740
> >   Read of size 4 at addr ffff88810921c038 by task poc/98
> >   Call Trace:
> >    ip_skb_dst_mtu+0x634/0x740
> >    __ip_finish_output.part.0+0x22/0x2c0
> >    ip_mc_output+0x287/0x930
> >    ip_send_skb+0x11d/0x150
> >    udp_send_skb+0x63e/0xdf0
> >    udp_sendmsg+0x1235/0x1da0
> >    __sys_sendto+0x32c/0x3a0
> >
> >   Allocated by task 97:
> >    __kvmalloc_node_noprof+0x1d4/0x620
> >    alloc_netdev_mqs+0x81/0x12c0
> >    rtnl_create_link+0xaa3/0xe30
> >    rtnl_newlink+0xabc/0x1f70
> >
> >   Freed by task 99:
> >    kfree+0x131/0x3c0
> >    device_release+0xc8/0x240
> >    kobject_put+0x14d/0x280
> >    netdev_run_todo+0x4cb/0xc70
> >    rtnl_dellink+0x362/0xa90
> >
> > Protect the device lookup and MTU read with RCU and use dst_dev_rcu() to
> > access the device pointer. Keep the MTU limit and headroom calculation
> > unchanged.
>
> This still leaves other potential UAFs in the ip_mc_output() path.
> Better to fix it by adding an RCU read-side critical section in
> ip_mc_output() in a similar fashion to its unicast counterpart. See
> commit 1dbf1d590d10 ("net: Add locking to protect skb->dev access in
> ip_output"). You can blame 4a6ce2b6f2ec ("net: introduce a new function
> dst_dev_put()").

Thanks for the reviews. The v2 patch has just been sent by applying
the method of 1dbf1d590d10 to ip_mc_output().

Best regards,
Chengfeng