netdev - Re: [PATCH] ipv6: mcast: extend RCU protection in igmp6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025082405-entomb-eligibly-c616@gregkh>
Date: Sun, 24 Aug 2025 08:03:42 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Chanho Min <chanho.min@....com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Alexey Kuznetsov <kuznet@....inr.ac.ru>,
	Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, gunho.lee@....com,
	stable@...r.kernel.org, Sasha Levin <sashal@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH] ipv6: mcast: extend RCU protection in igmp6_send()

On Mon, Aug 18, 2025 at 06:24:53PM +0900, Chanho Min wrote:
> From: Eric Dumazet <edumazet@...gle.com>
> 
> [ Upstream commit 087c1faa594fa07a66933d750c0b2610aa1a2946 ]
> 
> igmp6_send() can be called without RTNL or RCU being held.
> 
> Extend RCU protection so that we can safely fetch the net pointer
> and avoid a potential UAF.
> 
> Note that we no longer can use sock_alloc_send_skb() because
> ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.
> 
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk
> socket under RCU protection.
> 
> Cc: stable@...r.kernel.org # 5.4
> Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reviewed-by: David Ahern <dsahern@...nel.org>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com
> [ chanho: Backports to v5.4.y. v5.4.y does not include
> commit b4a11b2033b7(net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams),
> so IPSTATS_MIB_OUTREQUESTS was changed to IPSTATS_MIB_OUTPKGS defined as
> 'OutRequests'. ]

We can not take patches for only older kernel versions, as when you
upgrade you would have a regression.  Please send backports for all of
the missing stable versions and we will be glad to queue them up.

thanks,

greg k-h