Re: [PATCH] ip6mr: Serialize multicast router socket ownership

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Thu, 29 Oct 2026 21:22:21 -0700 you wrote:
> MRT6_TABLE checks whether the socket owns its current table before
> acquiring RTNL. MRT6_INIT also looks up its table before taking RTNL.
> Consequently, concurrent TABLE and INIT calls can initialize the old
> table and then change the socket's selected table. Another INIT can
> register the same socket in the new table.
> 
> rawv6_close() calls ip6mr_sk_done(), which clears only the first table
> owned by the socket. After the socket's RCU-delayed free, the other
> table retains a dangling mroute_sk pointer. A subsequent multicast cache
> report passes that pointer to sock_queue_rcv_skb_reason(). This produces
> a KASAN slab-use-after-free in sk_filter_trim_cap().
> 
> [...]

Here is the summary with links:
  - ip6mr: Serialize multicast router socket ownership
    https://git.kernel.org/netdev/net/c/c6b41de4dd9f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html