On 7/31/26 10:29 AM, Chengfeng Ye wrote:
fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
RTNL does not serialize this walk with PMTU exception updates. The walk
uses rcu_dereference_protected() with a constant true condition without
holding either fnhe_lock or an RCU read-side critical section.
The following interleaving can therefore occur:
CPU 0 CPU 1
fib_nhc_update_mtu() update_or_create_fnhe()
load fnhe spin_lock_bh(&fnhe_lock)
fnhe_remove_oldest()
unlink fnhe
kfree_rcu(fnhe, rcu)
<quiescent state>
access fnhe after grace period
KASAN reported:
BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
Read of size 8 at addr ffff888107d49000 by task poc/90
Call Trace:
fib_nhc_update_mtu+0x3df/0x410
fib_sync_mtu+0x7a/0xd0
fib_netdev_event+0x229/0x3f0
netif_set_mtu_ext+0x33a/0x570
dev_set_mtu+0x88/0x120
Allocated by task 89:
update_or_create_fnhe+0xa80/0x1110
__ip_rt_update_pmtu+0x8f2/0xcd0
ipv4_sk_update_pmtu+0x49e/0x690
udp_err+0xd92/0x1080
Freed by task 0:
__kasan_slab_free+0x43/0x70
kvfree_rcu_cb+0x12f/0x420
rcu_core+0x509/0x18e0
Protect the full walk with rcu_read_lock() and use rcu_dereference()
for the RCU-published pointers. This prevents reclaim from completing
until all references held by the walk have been dropped, without
serializing PMTU updates against the entire hash-table traversal.
Fixes: af7d6cce5369 ("net: ipv4: update fnhe_pmtu when first hop's MTU changes")
Cc: <redacted>
Signed-off-by: Chengfeng Ye <redacted>
---
net/ipv4/fib_semantics.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
Reviewed-by: David Ahern <dsahern@kernel.org>