IPv4 list receive can reuse a route from the previous skb in the same
receive batch. The current eligibility check only compares the destination
address and TOS before calling ip_route_use_hint().

For forwarded routes, ip_route_use_hint() skips fib_validate_source()
unless the hinted route is local. This means a packet with a different
source address can reuse a forwarding dst created for an earlier packet
and avoid source validation such as strict rp_filter.

In a KASAN QEMU router with strict rp_filter on the ingress device, a 
bad-only burst was dropped entirely, however, a paired valid/bad burst 
with the same destination/TOS made all of the bad packets pass rp_filter.

Require the source address to match before reusing the hint. Packets from
the same source/destination/TOS still take the fast path; packets whose
source changes go through the normal route lookup and source validation
path.

Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <redacted>
Reported-by: Yuxiang Yang <redacted>
Reported-by: Ao Wang <redacted>
Reported-by: Xuewei Feng <redacted>
Reported-by: Qi Li <redacted>
Reported-by: Ke Xu <redacted>
Assisted-by: Claude-Code:GLM-5.2-special
Signed-off-by: Yizhou Zhao <redacted>
---

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 9860178752b8..970a2c11ec2a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c

@@ -316,6 +316,7 @@ static bool ip_can_use_hint(const struct sk_buff *skb, const struct iphdr *iph,
 			    const struct sk_buff *hint)
 {
 	return hint && !skb_dst(skb) && ip_hdr(hint)->daddr == iph->daddr &&
+	       ip_hdr(hint)->saddr == iph->saddr &&
 	       ip_hdr(hint)->tos == iph->tos;
 }
 

-- 
2.47.3