Re: [PATCH net] ip6mr: do not clone dst in ip6mr_cache_report()

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Tue, 18 Aug 2026 17:27:55 +0000 you wrote:
> IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.
> When an ingress multicast packet misses MFC lookup,
> ip6mr_cache_unresolved() places the skb onto the unresolved queue,
> escaping the receive-side RCU grace period.
> 
> If the underlying route is deleted and freed, and the MFC queue is later
> resolved with a wrong parent interface, ip6_mr_forward() invokes
> ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes
> dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab
> use-after-free.
> 
> [...]

Here is the summary with links:
  - [net] ip6mr: do not clone dst in ip6mr_cache_report()
    https://git.kernel.org/netdev/net/c/235b42b58601

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html