AZL-96222

In the Linux kernel, the following vulnerability has been resolved:

rds: tcp: hold the RCU lock across ipv6chkaddr() in rdstcpladdr_check()

rdstcpladdrcheck() looks up a scoped IPv6 interface with devgetbyindexrcu(), drops the RCU read-side lock, and only then passes the bare struct netdevice * into ipv6chkaddr().

devgetbyindexrcu() only keeps the device alive within the same RCU read-side section. After rcureadunlock(), a concurrent RTMDELLINK can free the netdevice; ipv6chkaddr() then dereferences the stale pointer in _ipv6chkaddrandflags() (e.g. l3mdevmasterdevrcu(dev)), reading freed memory.

Keep the RCU read-side lock held across the ipv6chkaddr() call instead of dropping it right after the lookup, so the device cannot be freed while it is in use.

BUG: KASAN: slab-use-after-free in __ipv6chkaddr_andflags (... net/ipv6/addrconf.c:1998) Read of size 8 at addr ffff8880106ec000 by task exploit/153 Call Trace: ... kasanreport (mm/kasan/report.c:595) __ipv6chkaddrandflags (... net/ipv6/addrconf.c:1998) ipv6chkaddr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972) rdstcpladdrcheck (net/rds/tcp.c:370) rdsbind (net/rds/bind.c:248) __sys_bind (net/socket.c:1920) __x64sysbind (net/socket.c:1956) dosyscall64 (arch/x86/entry/syscall64.c:63) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121)