When a socket ignores the path MTU, ip_skb_dst_mtu() reads the device MTU without RCU protection. The multicast and broadcast output path through ip_mc_output() can reach this helper without an RCU read lock. Netfilter releases its internal read lock before calling ip_finish_output(). A sender can load dst->dev and then be preempted before reading dev->mtu. Concurrent device unregistration replaces dst->dev with blackhole_netdev and drops the old device reference. After the grace period and remaining references drain, the device can be freed before the sender resumes and reads its MTU, causing a use-after-free. KASAN reported: BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x634/0x740 Read of size 4 at addr ffff88810921c038 by task poc/98 Call Trace: ip_skb_dst_mtu+0x634/0x740 __ip_finish_output.part.0+0x22/0x2c0 ip_mc_output+0x287/0x930 ip_send_skb+0x11d/0x150 udp_send_skb+0x63e/0xdf0 udp_sendmsg+0x1235/0x1da0 __sys_sendto+0x32c/0x3a0 Allocated by task 97: __kvmalloc_node_noprof+0x1d4/0x620 alloc_netdev_mqs+0x81/0x12c0 rtnl_create_link+0xaa3/0xe30 rtnl_newlink+0xabc/0x1f70 Freed by task 99: kfree+0x131/0x3c0 device_release+0xc8/0x240 kobject_put+0x14d/0x280 netdev_run_todo+0x4cb/0xc70 rtnl_dellink+0x362/0xa90 Protect the device lookup and MTU read with RCU and use dst_dev_rcu() to access the device pointer. Keep the MTU limit and headroom calculation unchanged. Fixes: 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye --- include/net/ip.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/net/ip.h b/include/net/ip.h index 6f602df72ee6..14d6f77f3bb8 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -543,7 +543,9 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk, return ip_dst_mtu_maybe_forward(dst, forwarding); } - mtu = min(READ_ONCE(dst_dev(dst)->mtu), IP_MAX_MTU); + rcu_read_lock(); + mtu = min(READ_ONCE(dst_dev_rcu(dst)->mtu), IP_MAX_MTU); + rcu_read_unlock(); return mtu - lwtunnel_headroom(dst->lwtstate, mtu); } -- 2.43.0