]> www.infradead.org Git - users/willy/pagecache.git/commit
ipv6: mcast: extend RCU protection in igmp6_send()
authorEric Dumazet <edumazet@google.com>
Fri, 7 Feb 2025 13:58:40 +0000 (13:58 +0000)
committerJakub Kicinski <kuba@kernel.org>
Tue, 11 Feb 2025 02:09:10 +0000 (18:09 -0800)
commit087c1faa594fa07a66933d750c0b2610aa1a2946
tree3d71d9150dc8cf64ae890475ac4e630c0bf491d6
parented6ae1f325d3c43966ec1b62ac1459e2b8e45640
ipv6: mcast: extend RCU protection in igmp6_send()

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer
and avoid a potential UAF.

Note that we no longer can use sock_alloc_send_skb() because
ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk
socket under RCU protection.

Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/mcast.c