Re: [PATCH net v2] ipv6: fix fib6 walker UAF on NLM_F_REPLACE

[Ido Schimmel]

On Wed, Oct 28, 2026 at 12:00:18PM -0400, Cen Zhang (Microsoft) wrote:
> fib6_walker uses w->leaf to remember the next fib6_info to dump, so an
> RTM_GETROUTE dump can continue there on the next recvmsg().  This
> assumes that whoever removes a route from the tree also updates the
> walkers pointing at it.  fib6_del_route() does: it moves w->leaf to
> the next route.  The NLM_F_REPLACE branch of fib6_add_rt2node() does
> not: it removes the old route, fib6_add() frees it, and w->leaf keeps
> pointing at the freed object.
> 
> The fn_sernum version check in fib6_dump_table() normally protects
> against resuming on a stale w->leaf, but it can be bypassed:
> ip6_link_failure() resets fn_sernum to -1 when the default route
> fails, which an unprivileged user in a user+net namespace can cause:
> 
>   1) link failure            fn_sernum = -1
>   2) dump pauses on route R
>   3) replace R               fn_sernum changed, R freed
>   4) link failure            fn_sernum = -1
>   5) dump resumes            -1 == -1, reads freed R  <- UAF
> 
>   BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1c22/0x2cd0
>   Read of size 4 at addr ff11000011fa0064 by task poc/101
>    rt6_fill_node <- rt6_dump_route
> 
> Fix by adjusting walkers separately for replacement and deletion.
> For replacement, add fib6_walkers_replace_leaf() points w->leaf
> at the new route. For deletion and ECMP sibling removal,
> fib6_walkers_skip_rt() calls fib6_walkers_replace_leaf() with the
> next route. Reset w->skip_in_node when updating w->leaf, and set
> w->state to FWS_U when no next route remains.
> 
> Fixes: 4a287eba2de3 ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag")
> Cc: AutonomousCodeSecurity@xxxxxxxxxxxxx
> Signed-off-by: Cen Zhang (Microsoft) <cenzhang@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>