Re: [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output()

[Ido Schimmel]

On Tue, Sep 29, 2026 at 12:25:34AM +0800, Chengfeng Ye wrote:
> ip_mc_output() reads rt->dst.dev and stores it in skb->dev without RCU
> protection.  dst_dev_put() can concurrently replace the destination device

It can also be rt_flush_dev(), if the dst entry is uncached.

> and release the old device after an RCU grace period, leaving the multicast

The reference release is immediate, only the free happens after a GP.

> output path with a stale skb->dev.
> 
> The stale device can be dereferenced by the post-routing path.  In
> particular, a socket using IP_PMTUDISC_PROBE reaches ip_skb_dst_mtu() from
> ip_finish_output() and reads the freed device's MTU.

ip_skb_dst_mtu() reads the device from the dst entry, not from skb->dev.

> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740
>   Read of size 4 at addr ffff88810921c038 by task poc/98
>   Call Trace:
>    ip_skb_dst_mtu+0x634/0x740
>    __ip_finish_output.part.0+0x22/0x2c0
>    ip_mc_output+0x287/0x930
>    ip_send_skb+0x11d/0x150
>    udp_send_skb+0x63e/0xdf0
>    udp_sendmsg+0x1235/0x1da0
>    __sys_sendto+0x32c/0x3a0
> 
>   Freed by task 99:
>    kfree+0x131/0x3c0
>    device_release+0xc8/0x240
>    kobject_put+0x14d/0x280
>    netdev_run_todo+0x4cb/0xc70
>    rtnl_dellink+0x362/0xa90
> 
> Protect the whole multicast output path with an RCU read-side critical
> section, as ip_output() already does.  Load the destination device through
> skb_dst_dev_rcu() and keep it protected through the post-routing hooks and
> ip_finish_output().
> 
> Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
> ---
> Changes in v2:
> - Protect the whole ip_mc_output() path instead of only the MTU read.
> - Load the destination device with skb_dst_dev_rcu(), matching ip_output().
> - Use the commit that made dst device replacement RCU-protected as Fixes.
> 
> Link: https://lore.kernel.org/r/20260927071051.3693368-1-nicoyip.dev@xxxxxxxxx/ [v1]
> 
>  net/ipv4/ip_output.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)

The diff itself looks fine.

FTR, I'm aware of the discussion that wants an RCU critical section in
ip_local_out(), but:

1. Adding one in ip_mc_output() is consistent with other output
functions: ip_output(), ip6_output(), ip_mr_output(), ip6_mr_output(),
etc.

2. This patch doesn't affect the fast path, unlike an RCU critical
section in ip_local_out() [1].

3. Patching ip_local_out() doesn't cover all the process context callers
of dst_output() either.

And yes, I'm aware that more places suffer from this "problem". I opened
an internal ticket after seeing [2]. I will get to it eventually and
will target it at net-next since these UAFs are not very realistic as
evident from [2].

[1] https://lore.kernel.org/netdev/85c6016d-fb15-4c61-aab9-61448911f934@xxxxxxxxxx/
[2] https://lore.kernel.org/netdev/20260819164528.3761320-1-jjy600901@xxxxxxxxx/