Re: [PATCH net-next 1/9] sit: fix UAF in ipip6_tunnel_del_prl()
From: Lorenzo Bianconi <hidden>
Date: 2026-09-07 12:28:24
When flushing all potential router list (PRL) entries,
ipip6_tunnel_del_prl() called call_rcu(&x->rcu_head, prl_list_destroy_rcu)
before clearing t->prl.
A concurrent reader in isatap_chksrc() could enter an RCU read-side
critical section after call_rcu() but before t->prl is set to NULL,
allowing prl_list_destroy_rcu() to free nodes while the reader traverses
them.
Clear t->prl using RCU_INIT_POINTER() before invoking call_rcu().
Also use rcu_assign_pointer() when unlinking individual entries.
Fixes: ef9a9d1183b3 ("ipv6 sit: RCU conversion phase I")
Signed-off-by: Eric Dumazet <edumazet@google.com>Acked-by Lorenzo Bianconi [off-list ref]
quoted hunk ↗ jump to hunk
--- net/ipv6/sit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 19b7fa8d1a2a07991a00b250c5ae58819d104e79..4438b2472b28764f813b9162bdb9f6b6dee5a007 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c@@ -436,7 +436,7 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a) (x = rtnl_dereference(*p)) != NULL; p = &x->next) { if (x->addr == a->addr) { - *p = x->next; + rcu_assign_pointer(*p, rtnl_dereference(x->next)); kfree_rcu(x, rcu_head); t->prl_count--; goto out;@@ -447,8 +447,8 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a) x = rtnl_dereference(t->prl); if (x) { t->prl_count = 0; + RCU_INIT_POINTER(t->prl, NULL); call_rcu(&x->rcu_head, prl_list_destroy_rcu); - t->prl = NULL; } } out:-- 2.55.0.979.g7e5102b832-goog
Attachments
- signature.asc [application/pgp-signature] 228 bytes