* Re: [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output()
2026-09-28 16:25 [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output() Chengfeng Ye
@ 2026-09-29 8:37 ` Antoine Tenart
2026-09-29 9:42 ` Jiayuan Chen
2026-09-29 16:36 ` Ido Schimmel
2 siblings, 0 replies; 4+ messages in thread
From: Antoine Tenart @ 2026-09-29 8:37 UTC (permalink / raw)
To: Chengfeng Ye
Cc: David Ahern, Ido Schimmel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Martin KaFai Lau,
Wei Wang, Hangbin Liu, netdev, linux-kernel, stable
On Tue, Sep 29, 2026 at 12:25:34AM +0800, Chengfeng Ye wrote:
> ip_mc_output() reads rt->dst.dev and stores it in skb->dev without RCU
> protection. dst_dev_put() can concurrently replace the destination device
> and release the old device after an RCU grace period, leaving the multicast
> output path with a stale skb->dev.
>
> The stale device can be dereferenced by the post-routing path. In
> particular, a socket using IP_PMTUDISC_PROBE reaches ip_skb_dst_mtu() from
> ip_finish_output() and reads the freed device's MTU.
>
> KASAN reported:
>
> BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740
> Read of size 4 at addr ffff88810921c038 by task poc/98
> Call Trace:
> ip_skb_dst_mtu+0x634/0x740
> __ip_finish_output.part.0+0x22/0x2c0
> ip_mc_output+0x287/0x930
> ip_send_skb+0x11d/0x150
> udp_send_skb+0x63e/0xdf0
> udp_sendmsg+0x1235/0x1da0
> __sys_sendto+0x32c/0x3a0
>
> Freed by task 99:
> kfree+0x131/0x3c0
> device_release+0xc8/0x240
> kobject_put+0x14d/0x280
> netdev_run_todo+0x4cb/0xc70
> rtnl_dellink+0x362/0xa90
>
> Protect the whole multicast output path with an RCU read-side critical
> section, as ip_output() already does. Load the destination device through
> skb_dst_dev_rcu() and keep it protected through the post-routing hooks and
> ip_finish_output().
>
> Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
> ---
> Changes in v2:
> - Protect the whole ip_mc_output() path instead of only the MTU read.
> - Load the destination device with skb_dst_dev_rcu(), matching ip_output().
> - Use the commit that made dst device replacement RCU-protected as Fixes.
>
> Link: https://lore.kernel.org/r/20260927071051.3693368-1-nicoyip.dev@gmail.com/ [v1]
>
> net/ipv4/ip_output.c | 19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
>
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index a24cc8ee11d3..cf44597896cd 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -367,8 +367,11 @@ static int ip_mc_finish_output(struct net *net, struct sock *sk,
> int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> {
> struct rtable *rt = skb_rtable(skb);
> - struct net_device *dev = rt->dst.dev;
> + struct net_device *dev;
> + int ret;
>
> + rcu_read_lock();
> + dev = skb_dst_dev_rcu(skb);
> /*
> * If the indicated interface is up and running, send the packet.
> */
> @@ -406,7 +409,8 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
>
> if (ip_hdr(skb)->ttl == 0) {
> kfree_skb(skb);
> - return 0;
> + ret = 0;
> + goto out;
> }
> }
>
> @@ -418,10 +422,13 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> ip_mc_finish_output);
> }
>
> - return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> - net, sk, skb, NULL, skb->dev,
> - ip_finish_output,
> - !(IPCB(skb)->flags & IPSKB_REROUTED));
> + ret = NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> + net, sk, skb, NULL, skb->dev,
> + ip_finish_output,
> + !(IPCB(skb)->flags & IPSKB_REROUTED));
> +out:
> + rcu_read_unlock();
> + return ret;
> }
>
> int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> --
> 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output()
2026-09-28 16:25 [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output() Chengfeng Ye
2026-09-29 8:37 ` Antoine Tenart
@ 2026-09-29 9:42 ` Jiayuan Chen
2026-09-29 16:36 ` Ido Schimmel
2 siblings, 0 replies; 4+ messages in thread
From: Jiayuan Chen @ 2026-09-29 9:42 UTC (permalink / raw)
To: Chengfeng Ye, David Ahern, Ido Schimmel, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Martin KaFai Lau, Wei Wang
Cc: Hangbin Liu, netdev, linux-kernel, stable
On 9/29/26 12:25 AM, Chengfeng Ye wrote:
> ip_mc_output() reads rt->dst.dev and stores it in skb->dev without RCU
Could you take a look at this thread ?
https://lore.kernel.org/netdev/ahveCu-zzFlpeVut@v4bel/
It seems there are still a lot of similar paths to be considered.
> protection. dst_dev_put() can concurrently replace the destination device
> and release the old device after an RCU grace period, leaving the multicast
> output path with a stale skb->dev.
>
> The stale device can be dereferenced by the post-routing path. In
> particular, a socket using IP_PMTUDISC_PROBE reaches ip_skb_dst_mtu() from
> ip_finish_output() and reads the freed device's MTU.
>
> KASAN reported:
>
> BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740
> Read of size 4 at addr ffff88810921c038 by task poc/98
> Call Trace:
> ip_skb_dst_mtu+0x634/0x740
> __ip_finish_output.part.0+0x22/0x2c0
> ip_mc_output+0x287/0x930
> ip_send_skb+0x11d/0x150
> udp_send_skb+0x63e/0xdf0
> udp_sendmsg+0x1235/0x1da0
> __sys_sendto+0x32c/0x3a0
>
> Freed by task 99:
> kfree+0x131/0x3c0
> device_release+0xc8/0x240
> kobject_put+0x14d/0x280
> netdev_run_todo+0x4cb/0xc70
> rtnl_dellink+0x362/0xa90
>
> Protect the whole multicast output path with an RCU read-side critical
> section, as ip_output() already does. Load the destination device through
> skb_dst_dev_rcu() and keep it protected through the post-routing hooks and
> ip_finish_output().
>
> Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> ---
> Changes in v2:
> - Protect the whole ip_mc_output() path instead of only the MTU read.
> - Load the destination device with skb_dst_dev_rcu(), matching ip_output().
> - Use the commit that made dst device replacement RCU-protected as Fixes.
>
> Link: https://lore.kernel.org/r/20260927071051.3693368-1-nicoyip.dev@gmail.com/ [v1]
>
> net/ipv4/ip_output.c | 19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
>
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index a24cc8ee11d3..cf44597896cd 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -367,8 +367,11 @@ static int ip_mc_finish_output(struct net *net, struct sock *sk,
> int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> {
> struct rtable *rt = skb_rtable(skb);
> - struct net_device *dev = rt->dst.dev;
> + struct net_device *dev;
> + int ret;
>
> + rcu_read_lock();
> + dev = skb_dst_dev_rcu(skb);
> /*
> * If the indicated interface is up and running, send the packet.
> */
> @@ -406,7 +409,8 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
>
> if (ip_hdr(skb)->ttl == 0) {
> kfree_skb(skb);
> - return 0;
> + ret = 0;
> + goto out;
> }
> }
>
> @@ -418,10 +422,13 @@ int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> ip_mc_finish_output);
> }
>
> - return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> - net, sk, skb, NULL, skb->dev,
> - ip_finish_output,
> - !(IPCB(skb)->flags & IPSKB_REROUTED));
> + ret = NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
> + net, sk, skb, NULL, skb->dev,
> + ip_finish_output,
> + !(IPCB(skb)->flags & IPSKB_REROUTED));
> +out:
> + rcu_read_unlock();
> + return ret;
> }
>
> int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb)
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output()
2026-09-28 16:25 [PATCH net v2] ipv4: Fix device use-after-free in ip_mc_output() Chengfeng Ye
2026-09-29 8:37 ` Antoine Tenart
2026-09-29 9:42 ` Jiayuan Chen
@ 2026-09-29 16:36 ` Ido Schimmel
2 siblings, 0 replies; 4+ messages in thread
From: Ido Schimmel @ 2026-09-29 16:36 UTC (permalink / raw)
To: Chengfeng Ye
Cc: David Ahern, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Martin KaFai Lau, Wei Wang,
Hangbin Liu, netdev, linux-kernel, stable
On Tue, Sep 29, 2026 at 12:25:34AM +0800, Chengfeng Ye wrote:
> ip_mc_output() reads rt->dst.dev and stores it in skb->dev without RCU
> protection. dst_dev_put() can concurrently replace the destination device
It can also be rt_flush_dev(), if the dst entry is uncached.
> and release the old device after an RCU grace period, leaving the multicast
The reference release is immediate, only the free happens after a GP.
> output path with a stale skb->dev.
>
> The stale device can be dereferenced by the post-routing path. In
> particular, a socket using IP_PMTUDISC_PROBE reaches ip_skb_dst_mtu() from
> ip_finish_output() and reads the freed device's MTU.
ip_skb_dst_mtu() reads the device from the dst entry, not from skb->dev.
>
> KASAN reported:
>
> BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740
> Read of size 4 at addr ffff88810921c038 by task poc/98
> Call Trace:
> ip_skb_dst_mtu+0x634/0x740
> __ip_finish_output.part.0+0x22/0x2c0
> ip_mc_output+0x287/0x930
> ip_send_skb+0x11d/0x150
> udp_send_skb+0x63e/0xdf0
> udp_sendmsg+0x1235/0x1da0
> __sys_sendto+0x32c/0x3a0
>
> Freed by task 99:
> kfree+0x131/0x3c0
> device_release+0xc8/0x240
> kobject_put+0x14d/0x280
> netdev_run_todo+0x4cb/0xc70
> rtnl_dellink+0x362/0xa90
>
> Protect the whole multicast output path with an RCU read-side critical
> section, as ip_output() already does. Load the destination device through
> skb_dst_dev_rcu() and keep it protected through the post-routing hooks and
> ip_finish_output().
>
> Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> ---
> Changes in v2:
> - Protect the whole ip_mc_output() path instead of only the MTU read.
> - Load the destination device with skb_dst_dev_rcu(), matching ip_output().
> - Use the commit that made dst device replacement RCU-protected as Fixes.
>
> Link: https://lore.kernel.org/r/20260927071051.3693368-1-nicoyip.dev@gmail.com/ [v1]
>
> net/ipv4/ip_output.c | 19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
The diff itself looks fine.
FTR, I'm aware of the discussion that wants an RCU critical section in
ip_local_out(), but:
1. Adding one in ip_mc_output() is consistent with other output
functions: ip_output(), ip6_output(), ip_mr_output(), ip6_mr_output(),
etc.
2. This patch doesn't affect the fast path, unlike an RCU critical
section in ip_local_out() [1].
3. Patching ip_local_out() doesn't cover all the process context callers
of dst_output() either.
And yes, I'm aware that more places suffer from this "problem". I opened
an internal ticket after seeing [2]. I will get to it eventually and
will target it at net-next since these UAFs are not very realistic as
evident from [2].
[1] https://lore.kernel.org/netdev/85c6016d-fb15-4c61-aab9-61448911f934@redhat.com/
[2] https://lore.kernel.org/netdev/20260819164528.3761320-1-jjy600901@snu.ac.kr/
^ permalink raw reply [flat|nested] 4+ messages in thread