Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Zhou Qiuyue]

Thanks, David.

Yes, in the redirect case it passes the old rt->dst.dev, while skb->dst
has already been replaced. That changes the NF_HOOK outdev, so it
probably belongs in a separate fix.

A bare rt6i_idev or dst.dev pointer looks unsafe, since dropping the old
route drops the refs they rely on. An explicit hold/put could replace the
RCU lock, but adds per-packet refs, and doesn't avoid the deferred route
free. As far as I can tell, that uses the embedded dst rcu_head; the
temporary rt6 in this path comes from the existing HDRINCL lookup, and v2
doesn't add a new alloc/free there.

I'll test moving the RCU read lock before l3mdev_ip6_out().