From 66dfb2cacda7faae614d688943d85e75abf7f586 Mon Sep 17 00:00:00 2001 From: Zhou Qiuyue Date: Mon, 26 Oct 2026 12:48:08 +0800 Subject: [PATCH] ipv6: raw: fix use-after-free in rawv6_send_hdrinc() rawv6_send_hdrinc() caches the route before handing the skb to l3mdev_ip6_out(). The VRF output path may replace skb->dst and release the original route, leaving the cached pointer stale. The function later dereferences that pointer for statistics accounting and as the output device passed to NF_HOOK(). Its RCU read-side critical section starts after l3mdev_ip6_out(), so it cannot prevent the old route from being reclaimed in between. Reload the route from the current skb destination after l3mdev_ip6_out() returns. KASAN reports a slab-use-after-free in rawv6_sendmsg(), with the route allocated by ip6_dst_alloc(), freed by dst_destroy() from rcu_core(), and the related RCU callback queued from vrf_l3_out(). Fixes: 4c1feac58e06 ("net: vrf: Flip IPv6 output path from FIB lookup hook to out hook") Cc: stable@vger.kernel.org Signed-off-by: Zhou Qiuyue Reviewed-by: Hangbin Liu Signed-off-by: Dave Miller --- net/ipv6/raw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index b965258cf9e5..bdea825434ea 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, if (unlikely(!skb)) return 0; + /* l3mdev_ip6_out() may have replaced the skb dst. */ + rt = dst_rt6_info(skb_dst(skb)); + /* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev * in the error path. Since skb has been freed, the dst could * have been queued for deletion.