From nobody Mon Sep 28 05:45:31 2026 Received: from mail-lr2-f7.google.com (mail-lr2-f7.google.com [74.125.230.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5329364042 for ; Wed, 26 Aug 2026 06:30:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787725829; cv=none; b=CqsQlB7khpNFad4Z/qts8mLzz5KWM1AzCpnlEVQpZA/vF8BRa+7VlGDD6VA4yQK77KELbv8WdpQSBNn85ZFdZ4kxzsOZAX0eOJ7HnBh37plixaziDBl/abZvWbDQl6jPAUEUDc4/lOJNGE3gTR9bsGKMXCv0zDPiWQ8XZdFmCL4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787725829; c=relaxed/simple; bh=88cwRlOGDn0vpOQmUYNZUGYEdRzAeKkeMTlTyzUNsZU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=b2YhWbuhvsTXReaVZEpXQWqG7xxTMIb7V9TvFudU+gFTjtyIOqI990p+VGX0UNdmRHPE8OV46cdbJSp3xbHBTps1r+H8YLO8/bOAhThVBIeBouXFFWIYI1wJGwSwDi5KrKoevY8hwswACnRDmgJA7HLLMoNFMJqUa8kTUtHl63o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZBXkCEJ6; arc=none smtp.client-ip=74.125.230.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZBXkCEJ6" Received: by mail-lr2-f7.google.com with SMTP id 38308e7fff4ca-39c689d1d48so2777381fa.1 for ; Tue, 25 Aug 2026 23:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787725823; x=1788330623; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Ltu0ibAXLu3xOE6Vns9ZIohMj7npj3m+gIbL5j+64fw=; b=ZBXkCEJ6FKvXL7u4d6F3MzhYY5B8APtuSxPxw6roiPKBN98gRySghXrg5VOjElkJPu n6NbFttPRob3PV+Kz91j+KHJGE3enb1ET+mJppySypsWQFM3dPBGtXAyLzN41BVWXqRV qwl7OI3iarYV+8+71/Lir/z8EJPrD6ltwtMvM1dU6Fl/pYaO5zKrQ1zbwOc7SDcCbf95 lARn/BeHdFajJNIzbW3jSjoh+IjWRaqPHkE84wuIykbgKCoLg8G81bgJihcz3h7S+vRy Hkcv4fjEgcTCiVmYZ0D18KlKBUUyy8pddKQ7xVm32ts21l8tMSuryoymwon7pkapzjcL 6gSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787725823; x=1788330623; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ltu0ibAXLu3xOE6Vns9ZIohMj7npj3m+gIbL5j+64fw=; b=GdfsFDYkF3CVBi17PfxRzWgNy721AnYEfGApAwJfrnKzPqFWwPAD+fYfXMvX1Uk80J /RX2qs9Rgj/8LXke06kCyqbb80cRZtKWpBZS+YmAsLe7jrxN5mLJr4YpCZHX07iaIw43 b0N6U/1noBcJ2edt4p8w914ceumuD57RzPTT1ZbbePIS4d4SfspS2NPKNCGIQnm6hHzo Yy4AqfgynysX58XSz3zmFblNCuINzeORuhs3lf4GTUql+QRuqE9NkyjiFYb/wRv3u7LX UTU6w5/2w3QqnADfZG/LdwDrbrmZH9SNLPNlJuA1+RAuFoUbKXItuODF22xiPpS9CpKt T1WQ== X-Forwarded-Encrypted: i=1; AHgh+RrYCaGsrzQD7eL9u+qVIw403qggMs9bNTSmNOoxtE7bfpeIxUFrMtZfnUTTSvVoexBu7G7nCpVqPAXb5SY=@vger.kernel.org X-Gm-Message-State: AFuF++mKblAiIaUJth7nZKlZNTHwmcYgAy5t2svC/Q3johki4zEjK4ch 1wiiy6GVHzPLXwE+NNpJc+AibjtXqLlh3os/9GkPLuw8Zq/NURytRdRE X-Gm-Gg: AR+sD10nznTQOhTFuyPYBkB4KL7lCTzVqSU0pSzsqHApNE5fC3kvioLOE03x9WiyJto I1h8TXJT5QS+Mz0YPftLdKaRSNzWwwnzFza8gOBHdiOkK8gjwovnt5cpwH5ZisTfsaMMxyVXRXR 09DhhGfdoqhS1RRbxqJWNWOS0ieE6wSIWXmCf9srRalzHcGYDAa4pZTIGI18ihAdL9yHh5rDh27 6u3V6CsNsEWdyxG971Sj+YCMCO3lZoO9oHeHt/ajBFKNT69GWhToU+iYvkFjmUSbp/qeGK4bcJF t6by430B3ZXkZ5sqaA8GIZqG0XZ5rtBTUnWOt2gsZ5nnXhrbnbxQCLxdMH9frJPrXuqfNqOdXU4 NTJUWCGn7Pt1wdWBHbQswqx8dcrpxuLwJ4/nbkJBQax2lH0IMPzb3nraFV2U2YNcFa4a43L5ccu Lr8ULAwSKfPOAhdY7+OunZ29TBu2opXaKm3KXSW/pltqtkHlXvHAFL+3WlE0JJulbHU74E1+KB4 tEfVA== X-Received: by 2002:a05:651c:a38a:20b0:3a1:a0fe:990a with SMTP id 38308e7fff4ca-3a1fd63423emr6446281fa.10.1787725822342; Tue, 25 Aug 2026 23:30:22 -0700 (PDT) Received: from localhost.localdomain ([78.40.184.2]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3a1fd0eb0d7sm3336591fa.24.2026.08.25.23.30.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 23:30:21 -0700 (PDT) From: Roman Demidov To: "David S. Miller" Cc: Roman Demidov , Alexey Kuznetsov , Hideaki YOSHIFUJI , Jakub Kicinski , Arnaldo Carvalho de Melo , Yan Zheng , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, Leo Lin , David Ahern , Ido Schimmel , Eric Dumazet , Jiayuan Chen , Greg Kroah-Hartman Subject: [PATCH 5.10] ipv6: mcast: Fix use-after-free when processing MLD queries Date: Wed, 26 Aug 2026 09:29:38 +0300 Message-ID: <20260826062942.5272-1-roman.demidov.nn@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ido Schimmel commit 791c91dc7a9dfb2457d5e29b8216a6484b9c4b40 upstream. When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull() calls, leading to a use-after-free [1]. Fix by copying the multicast group address when the packet is initially parsed. [1] BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512) Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118 Workqueue: mld mld_query_work Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_address_description.constprop.0 (mm/kasan/report.c:378) print_report (mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) __mld_query_work (net/ipv6/mcast.c:1512) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [...] Freed by task 118: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:= 6566) pskb_expand_head (net/core/skbuff.c:2335) __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4)) __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1)) mld_query_work (net/ipv6/mcast.c:1563) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Fixes: 97300b5fdfe2 ("[MCAST] IPv6: Check packet size when process Multicas= t") Reported-by: Leo Lin Reviewed-by: David Ahern Signed-off-by: Ido Schimmel Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260603101811.612594-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Signed-off-by: Roman Demidov --- Backport fix for CVE-2026-53275 net/ipv6/mcast.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index e15c3e2318d7..c4a9866ea45b 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1414,9 +1414,9 @@ void igmp6_event_query(struct sk_buff *skb) static void __mld_query_work(struct sk_buff *skb) { struct mld2_query *mlh2 =3D NULL; - const struct in6_addr *group; unsigned long max_delay; struct inet6_dev *idev; + struct in6_addr group; struct ifmcaddr6 *ma; struct mld_msg *mld; int group_type; @@ -1448,8 +1448,8 @@ static void __mld_query_work(struct sk_buff *skb) goto kfree_skb; =20 mld =3D (struct mld_msg *)icmp6_hdr(skb); - group =3D &mld->mld_mca; - group_type =3D ipv6_addr_type(group); + group =3D mld->mld_mca; + group_type =3D ipv6_addr_type(&group); =20 if (group_type !=3D IPV6_ADDR_ANY && !(group_type&IPV6_ADDR_MULTICAST)) @@ -1501,7 +1501,7 @@ static void __mld_query_work(struct sk_buff *skb) } } else { for_each_mc_mclock(idev, ma) { - if (!ipv6_addr_equal(group, &ma->mca_addr)) + if (!ipv6_addr_equal(&group, &ma->mca_addr)) continue; if (ma->mca_flags & MAF_TIMER_RUNNING) { /* gsquery <- gsquery && mark */ --=20 2.53.0