Re: [PATCH net] ipv6: take rcu lock in rawv6_send_hdrinc()

From: Wei Wang <redacted>
Date: Thu,  4 Oct 2018 10:12:37 -0700

From: Wei Wang <redacted>

In rawv6_send_hdrinc(), in order to avoid an extra dst_hold(), we
directly assign the dst to skb and set passed in dst to NULL to avoid
double free.
However, in error case, we free skb and then do stats update with the
dst pointer passed in. This causes use-after-free on the dst.
Fix it by taking rcu read lock right before dst could get released to
make sure dst does not get freed until the stats update is done.
Note: we don't have this issue in ipv4 cause dst is not used for stats
update in v4.

Syzkaller reported following crash:

 ...

Fixes: 1789a640f556 ("raw: avoid two atomics in xmit")
Signed-off-by: Wei Wang <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com> 

Applied and queued up for -stable, thanks.