From nobody Sat Jul 25 00:16:24 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D20204582CB for ; Tue, 21 Jul 2026 23:28:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784676502; cv=none; b=jGvmLCR9ftzp/zdHKbsukvx4Vt1kYzZ46xM6xGs4NO4wVFd6elHg+dU6tJh/hpgQx8iQFpHctIaTs4/cl1qnnvnwiy1MKGDQx8jR+cFBIQ69rIXwefemGjk56K6aJtO3AjyZaGXEA75Iz88l3+bGIPL35AqZoO9TbEE6uFgZiFU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784676502; c=relaxed/simple; bh=irVTV74mVuOuLu8jU6nhDyNRWI0SVtaJWyZgTsXu7us=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=apvqGKKDTdZ6e2ShQ0S6xk6j+AjE2aR/hnHzlAiBFvQEe6aBGYxeA66SfdyaQbcyEugsy8bjQypLFVMLeuPDZvdMDI2hQ/38rVlTHoA0FOIkq/VOGqy02yuyPPF/o2sumpi2xgXYTpWtAhbc7N9C6EbcugGyT9dtxfNT/MG8iXg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=Z9viuVl+; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="Z9viuVl+" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2ceaf8a1265so119327405ad.2 for ; Tue, 21 Jul 2026 16:28:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1784676492; x=1785281292; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3qrZVVtwbHqwgSrHi3jW4izH2aGoGZ3Oe5m0UJ7ploA=; b=Z9viuVl+LIZP5fXAcmuVIl9pvUs2+oljzkQeayt4Uz53vC3LaDDWRpHsn6slOB23TE 9s3Vl5CUUoEtRF70b1QWFLw8H8xupiL6UpmoueY/pZLGD3WvF9K49S28fG5gbreXtkis REb1wy403Q0k78l7+/+BeJRN+GitgHZgc7ROjJBB00/u444E23+hYS/qaLCOGcmKm/st mmO/NT8BkH+a8xM4/etjvOcQcBYJeCG36i07UqbUfsB9t0vSLjna4ke13GS2xvnFbaJD bfiGjdAIUtbmb0KWAoGuP4tNoMpg1OdU05ahSS5tzl7SsJjm+40wsYVlHE9FkseSTrBo hMSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784676492; x=1785281292; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3qrZVVtwbHqwgSrHi3jW4izH2aGoGZ3Oe5m0UJ7ploA=; b=c21gN56P7VpZZwNYRBZHRDwrw8GmeNvHeAiihDSeLs085Xwf9mCcKF5Fa8d1Zp3LQR eHosfppQ12CkYmEsuvb1hcQ5P/NplTpk5GOZFdMxAGjb8Di0C0YATjPfbaAxRuct97V3 vhcywstocKTvixdsEiFp3pCM4x1vOSgRhN0FtNlf0f4Euij0mqZ0gbq/YgFne2T8TN+A tUpkhEB13e3B8Wi3+MYg/BgbdFya8H26RHQcRgbIE8D2LwE3bd+/Q46JZwczs5F/otLw 1lw833eB2cvzBJA+y92gN78s/bhbwj+kLDA40t0pNFLhR6sZQyXlGJlNHck3bESS4bA7 0Uxg== X-Forwarded-Encrypted: i=1; AHgh+RqgYXdrs22nCfjby487DRjkGpYlYWjHGM2dRX0K8SNImmN+XggOsmfW4qRUx8vUJ6nV17CJeoV5Bp/1O3Q=@vger.kernel.org X-Gm-Message-State: AOJu0YwuwkSrkk0SPP2sh6w5vJV/B9y0yoxJ7rFJIbPeGjHv8BTpoH9x 8EFotirsspDaN3oeHEzZq//TaUcsZzygL9YxK9eWWwiLy5z5Z9/lsV6GsE+1oM6ZTg== X-Gm-Gg: AR+sD13UbUlYLTyUKjZ+7c7Dbx+50VHsKmXuxhqeldlKcJWIbGC4PlQQrqaEc1yUjdO 0jW2SaGhUqiZ8ydgBMIuRHvnbIgVCMWBqVtVds3cVBDYzmIOqwnfUbgMvwJYGr8g1W/UZmzkCUh iBUKAXg9SsDZnjHX5FdDal0CzIK7mzBTbjRlKwpxU2lUcpRuVbei4s4vB9Gl807VqizMig3WMm7 F9vSH7IAP+ln6i/KhuoSuh6mmmm0MipeYvJG1PjQg/YO0OLC4PFInZzZfuRoU7tR4V9unHFpkJO nMD30GyIZqwliGJnl1ePQYJd2YEeIs6gnxtn4VWjT/r+XgEh1yZTGA40KWuocDlQPRdYLD83LcJ shS4fE3rgsV34GtbdzotkhaNnLM6UataNRT74OCxTVBDrQCIFLivzYcDlV9qKqXvL457MdAq2Nq dBPApsci8= X-Received: by 2002:a17:902:d491:b0:2ca:bb7e:29a7 with SMTP id d9443c01a7336-2cf34a76fe0mr238495075ad.41.1784676492429; Tue, 21 Jul 2026 16:28:12 -0700 (PDT) Received: from xiang.tailc0aff1.ts.net ([20.171.14.70]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm2633629eec.27.2026.07.21.16.28.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 16:28:12 -0700 (PDT) From: "Xiang Mei (Microsoft)" To: Taehee Yoo , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, "Xiang Mei (Microsoft)" Subject: [PATCH net] amt: linearize skb in amt_rcv() to fix use-after-free of cached headers Date: Tue, 21 Jul 2026 23:28:05 +0000 Message-ID: <20260721232805.2451198-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The AMT message handlers cache pointers into the skb linear area (grec, iph, ip6h, eth) and keep using them across ip_mc_may_pull() / pskb_may_pull(). On a non-linear skb (e.g. a reassembled fragmented AMT membership update) such a pull can reallocate skb->head via pskb_expand_head(), leaving those pointers dangling into freed memory. Linearize the skb on entry to amt_rcv() so no later pull reallocates the head. This is a no-op for the common linear skb, and covers all handlers at once. Drop the packet if linearization fails. BUG: KASAN: slab-use-after-free in amt_igmpv3_report_handler (drivers/net= /amt.c:2023) Read of size 4 at addr ffff888013fdd71c by task exploit Call Trace: amt_igmpv3_report_handler (drivers/net/amt.c:2023) amt_update_handler (drivers/net/amt.c:2503) amt_rcv (drivers/net/amt.c:2846) udp_queue_rcv_one_skb (net/ipv4/udp.c:2389) udp_unicast_rcv_skb (net/ipv4/udp.c:2580) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:612) __netif_receive_skb_one_core (net/core/dev.c:6212) Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Xiang Mei (Microsoft) --- drivers/net/amt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/amt.c b/drivers/net/amt.c index 951dd10e192b..2bce99d45d2c 100644 --- a/drivers/net/amt.c +++ b/drivers/net/amt.c @@ -2785,6 +2785,10 @@ static int amt_rcv(struct sock *sk, struct sk_buff *= skb) } =20 skb->dev =3D amt->dev; + if (skb_linearize(skb)) { + err =3D true; + goto drop; + } iph =3D ip_hdr(skb); type =3D amt_parse_type(skb); if (type =3D=3D -1) { --=20 2.43.0