amt: linearize skb in amt_rcv() to fix use-after-free of cached headers

[PATCH net] amt: linearize skb in amt_rcv() to fix use-after-free of cached headers

Posted by Xiang Mei (Microsoft) 3 days ago

The AMT message handlers cache pointers into the skb linear area (grec,
iph, ip6h, eth) and keep using them across ip_mc_may_pull() /
pskb_may_pull(). On a non-linear skb (e.g. a reassembled fragmented AMT
membership update) such a pull can reallocate skb->head via
pskb_expand_head(), leaving those pointers dangling into freed memory.

Linearize the skb on entry to amt_rcv() so no later pull reallocates the
head. This is a no-op for the common linear skb, and covers all handlers
at once. Drop the packet if linearization fails.

  BUG: KASAN: slab-use-after-free in amt_igmpv3_report_handler (drivers/net/amt.c:2023)
  Read of size 4 at addr ffff888013fdd71c by task exploit
  Call Trace:
   <IRQ>
   amt_igmpv3_report_handler (drivers/net/amt.c:2023)
   amt_update_handler (drivers/net/amt.c:2503)
   amt_rcv (drivers/net/amt.c:2846)
   udp_queue_rcv_one_skb (net/ipv4/udp.c:2389)
   udp_unicast_rcv_skb (net/ipv4/udp.c:2580)
   ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
   ip_local_deliver_finish (net/ipv4/ip_input.c:242)
   ip_local_deliver (net/ipv4/ip_input.c:262)
   ip_rcv (net/ipv4/ip_input.c:612)
   __netif_receive_skb_one_core (net/core/dev.c:6212)

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 drivers/net/amt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 951dd10e192b..2bce99d45d2c 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -2785,6 +2785,10 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
 	}
 
 	skb->dev = amt->dev;
+	if (skb_linearize(skb)) {
+		err = true;
+		goto drop;
+	}
 	iph = ip_hdr(skb);
 	type = amt_parse_type(skb);
 	if (type == -1) {
-- 
2.43.0

Re: [PATCH net] amt: linearize skb in amt_rcv() to fix use-after-free of cached headers

Posted by Eric Dumazet 2 days, 23 hours ago

On Wed, Jul 22, 2026 at 1:28 AM Xiang Mei (Microsoft) <xmei5@asu.edu> wrote:
>
> The AMT message handlers cache pointers into the skb linear area (grec,
> iph, ip6h, eth) and keep using them across ip_mc_may_pull() /
> pskb_may_pull(). On a non-linear skb (e.g. a reassembled fragmented AMT
> membership update) such a pull can reallocate skb->head via
> pskb_expand_head(), leaving those pointers dangling into freed memory.
>
> Linearize the skb on entry to amt_rcv() so no later pull reallocates the
> head. This is a no-op for the common linear skb, and covers all handlers
> at once. Drop the packet if linearization fails.
>
>   BUG: KASAN: slab-use-after-free in amt_igmpv3_report_handler (drivers/net/amt.c:2023)
>   Read of size 4 at addr ffff888013fdd71c by task exploit
>   Call Trace:
>    <IRQ>
>    amt_igmpv3_report_handler (drivers/net/amt.c:2023)
>    amt_update_handler (drivers/net/amt.c:2503)
>    amt_rcv (drivers/net/amt.c:2846)
>    udp_queue_rcv_one_skb (net/ipv4/udp.c:2389)
>    udp_unicast_rcv_skb (net/ipv4/udp.c:2580)
>    ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
>    ip_local_deliver_finish (net/ipv4/ip_input.c:242)
>    ip_local_deliver (net/ipv4/ip_input.c:262)
>    ip_rcv (net/ipv4/ip_input.c:612)
>    __netif_receive_skb_one_core (net/core/dev.c:6212)
>
> Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
>  drivers/net/amt.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> index 951dd10e192b..2bce99d45d2c 100644
> --- a/drivers/net/amt.c
> +++ b/drivers/net/amt.c
> @@ -2785,6 +2785,10 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
>         }
>
>         skb->dev = amt->dev;
> +       if (skb_linearize(skb)) {
> +               err = true;
> +               goto drop;
> +       }
>         iph = ip_hdr(skb);
>         type = amt_parse_type(skb);
>         if (type == -1) {
> --
> 2.43.0
>

You are essentially killing the performance and usability of this module.

pw-bot: cr

Re: [PATCH net] amt: linearize skb in amt_rcv() to fix use-after-free of cached headers

Posted by Xiang Mei 2 days, 23 hours ago

On Tue, Jul 21, 2026 at 5:10 PM Eric Dumazet <edumazet@google.com> wrote:
>
> On Wed, Jul 22, 2026 at 1:28 AM Xiang Mei (Microsoft) <xmei5@asu.edu> wrote:
> >
> > The AMT message handlers cache pointers into the skb linear area (grec,
> > iph, ip6h, eth) and keep using them across ip_mc_may_pull() /
> > pskb_may_pull(). On a non-linear skb (e.g. a reassembled fragmented AMT
> > membership update) such a pull can reallocate skb->head via
> > pskb_expand_head(), leaving those pointers dangling into freed memory.
> >
> > Linearize the skb on entry to amt_rcv() so no later pull reallocates the
> > head. This is a no-op for the common linear skb, and covers all handlers
> > at once. Drop the packet if linearization fails.
> >
> >   BUG: KASAN: slab-use-after-free in amt_igmpv3_report_handler (drivers/net/amt.c:2023)
> >   Read of size 4 at addr ffff888013fdd71c by task exploit
> >   Call Trace:
> >    <IRQ>
> >    amt_igmpv3_report_handler (drivers/net/amt.c:2023)
> >    amt_update_handler (drivers/net/amt.c:2503)
> >    amt_rcv (drivers/net/amt.c:2846)
> >    udp_queue_rcv_one_skb (net/ipv4/udp.c:2389)
> >    udp_unicast_rcv_skb (net/ipv4/udp.c:2580)
> >    ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
> >    ip_local_deliver_finish (net/ipv4/ip_input.c:242)
> >    ip_local_deliver (net/ipv4/ip_input.c:262)
> >    ip_rcv (net/ipv4/ip_input.c:612)
> >    __netif_receive_skb_one_core (net/core/dev.c:6212)
> >
> > Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> > Reported-by: AutonomousCodeSecurity@microsoft.com
> > Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> > ---
> >  drivers/net/amt.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> > index 951dd10e192b..2bce99d45d2c 100644
> > --- a/drivers/net/amt.c
> > +++ b/drivers/net/amt.c
> > @@ -2785,6 +2785,10 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb)
> >         }
> >
> >         skb->dev = amt->dev;
> > +       if (skb_linearize(skb)) {
> > +               err = true;
> > +               goto drop;
> > +       }
> >         iph = ip_hdr(skb);
> >         type = amt_parse_type(skb);
> >         if (type == -1) {
> > --
> > 2.43.0
> >
>
> You are essentially killing the performance and usability of this module.
>
> pw-bot: cr

Thanks for your review. I focus too much on a small and elegant patch,
ignoring the functionality, Lol.
I'll revise after understanding the performance concerns.

Xiang