linux-kernel - Re: [PATCH] ipv6: mcast: extend RCU protection in igmp6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <062219ff-6abf-4289-84da-67a5c731564e@redhat.com>
Date: Thu, 21 Aug 2025 11:23:23 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Chanho Min <chanho.min@....com>, "David S . Miller"
 <davem@...emloft.net>, Alexey Kuznetsov <kuznet@....inr.ac.ru>,
 Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, gunho.lee@....com,
 stable@...r.kernel.org, Sasha Levin <sashal@...nel.org>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH] ipv6: mcast: extend RCU protection in igmp6_send()

On 8/18/25 11:24 AM, Chanho Min wrote:
> From: Eric Dumazet <edumazet@...gle.com>
> 
> [ Upstream commit 087c1faa594fa07a66933d750c0b2610aa1a2946 ]
> 
> igmp6_send() can be called without RTNL or RCU being held.
> 
> Extend RCU protection so that we can safely fetch the net pointer
> and avoid a potential UAF.
> 
> Note that we no longer can use sock_alloc_send_skb() because
> ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.
> 
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk
> socket under RCU protection.
> 
> Cc: stable@...r.kernel.org # 5.4
> Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reviewed-by: David Ahern <dsahern@...nel.org>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com
> [ chanho: Backports to v5.4.y. v5.4.y does not include
> commit b4a11b2033b7(net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams),
> so IPSTATS_MIB_OUTREQUESTS was changed to IPSTATS_MIB_OUTPKGS defined as
> 'OutRequests'. ]
> Signed-off-by: Chanho Min <chanho.min@....com>
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>

FWIW, the SoB chain above looks incorrect, as I think that neither Jakub
nor Sasha have touched yet this patch.

/P