Re: [PATCH net v2] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

[Antoine Tenart <atenart@kernel.org>]

On Tue, Oct 27, 2026 at 09:38:34AM +0800, Hangbin Liu wrote:
> On Mon, Oct 26, 2026 at 04:07:40PM +0100, Antoine Tenart wrote:
> > On Mon, Oct 26, 2026 at 02:09:23PM +0800, Hangbin Liu wrote:
> > > On Mon, Oct 26, 2026 at 12:48:08PM +0800, Zhou Qiuyue wrote:
> > > > diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> > > > index b965258cf..bdea82543 100644
> > > > --- a/net/ipv6/raw.c
> > > > +++ b/net/ipv6/raw.c
> > > > @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
> > > >  	if (unlikely(!skb))
> > > >  		return 0;
> > > >  
> > > > +	/* l3mdev_ip6_out() may have replaced the skb dst. */
> > > > +	rt = dst_rt6_info(skb_dst(skb));
> > > > +
> > > >  	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
> > > >  	 * in the error path. Since skb has been freed, the dst could
> > > >  	 * have been queued for deletion.
> > > 
> > > Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
> > 
> > Doesn't this change the device seen by the nf hook / used for the stats?
> 
> Should we still use the old/released rt->dst.dev after the VRF output
> path replace skb->dst? vrf_ip6_out_redirect() said it allows the nf hook
> use vrf device.

Right, but then in the direct path the NF_INET_LOCAL_OUT hook would be
run twice with the same dev. Looking at other call sites for
l3mdev_ip6_out, it's not clear either,  __ip6_local_out reloads the dev
while ip6_xmit does not. I'm not sure what is the expected behavior.

Regardless of that, the change in behavior (if right) would be worth
mentioning in the commit log.