[PATCH net 1/1] ipv6: orphan prefetched skb before ip6_mr_input

ip6_rcv_core() keeps skb->sk alive when it was installed by early
demux with sock_pfree so later receive-side code can use the prefetched
socket under RCU. ip6_mc_input() breaks that assumption in the
deliver == false path by handing the original skb to ip6_mr_input(),
which can queue or forward it after the receive-side RCU section ends.

A UDPv6 early-demuxed multicast packet that is not locally deliverable
but still enters multicast forwarding can therefore carry a dangling
socket pointer into unresolved mroute cleanup and later hit
sock_pfree() after the matched socket has already been destroyed.

Orphan the original skb before giving it to ip6_mr_input() when there
is no local delivery. The deliver == true path already uses
skb_clone(), which clears skb->sk and the destructor state.

Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Signed-off-by: Zhiling Zou <[email protected]>
---
 net/ipv6/ip6_input.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 8972863c93ee5..d332ec60f9150 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -622,6 +622,7 @@ int ip6_mc_input(struct sk_buff *skb)
 		if (deliver) {
 			skb2 = skb_clone(skb, GFP_ATOMIC);
 		} else {
+			skb_orphan(skb);
 			skb2 = skb;
 			skb = NULL;
 		}
-- 
2.43.0