AZL-94476

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix skdstcache double-free in xfrmuserpolicy()

xfrmuserpolicy() clears the socket dst cache with __skdstreset(), i.e. the non-atomic _skdstset(sk, NULL): it reads skdstcache with rcudereferenceprotected(), stores NULL and dstrelease()s the old dst. That is only safe if no other thread modifies skdstcache concurrently.

For a connected UDP socket that does not hold: the transmit fast path (udpsendmsg -> skdstcheck -> skdstreset) resets the cache locklessly with an atomic xchg(). A per-socket policy change racing a send can make both sides observe the same old dst and each dstrelease() it, dropping the socket's single reference twice and freeing the xfrm_dst bundle while it is still referenced:

BUG: KASAN: slab-use-after-free in dstrelease Write of size 4 at addr ffff88801897b6c0 by task exploit/155 Call Trace: ... dstrelease (... ./include/linux/rcuref.h:109) xfrmuserpolicy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrmstate.c:3053) doipsetsockopt (net/ipv4/ipsockglue.c:1347) ipsetsockopt (net/ipv4/ipsockglue.c:1417) dosocksetsockopt (net/socket.c:2368) __sys_setsockopt (net/socket.c:2393) __x64syssetsockopt (net/socket.c:2396) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121)

Reachable by an unprivileged user via a user+network namespace.

Use the atomic skdstreset() so the cache is cleared and released with a single xchg(): whichever side wins releases the dst once, the other sees NULL and does nothing. Behaviour is otherwise unchanged.