FAILED: patch "[PATCH] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()" failed to apply to 5.10-stable tree

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 66dfb2cacda7faae614d688943d85e75abf7f586
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '[email protected]' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Thanks,
Sasha

------------------ original commit in Linus's tree ------------------

From 66dfb2cacda7faae614d688943d85e75abf7f586 Mon Sep 17 00:00:00 2001
From: Zhou Qiuyue <[email protected]>
Date: Mon, 26 Oct 2026 12:48:08 +0800
Subject: [PATCH] ipv6: raw: fix use-after-free in rawv6_send_hdrinc()

rawv6_send_hdrinc() caches the route before handing the skb to l3mdev_ip6_out(). The VRF output path may replace skb->dst and release the original route, leaving the cached pointer stale.

The function later dereferences that pointer for statistics accounting and as the output device passed to NF_HOOK(). Its RCU read-side critical section starts after l3mdev_ip6_out(), so it cannot prevent the old route from being reclaimed in between.

Reload the route from the current skb destination after l3mdev_ip6_out() returns.

KASAN reports a slab-use-after-free in rawv6_sendmsg(), with the route allocated by ip6_dst_alloc(), freed by dst_destroy() from rcu_core(), and the related RCU callback queued from vrf_l3_out().

---
 net/ipv6/raw.c | 3 +++
 1 file changed, 3 insertions(+)

index b965258cf9e5f..bdea825434ea7 100644
@@ -654,6 +654,9 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
 	if (unlikely(!skb))
 		return 0;
 
+	/* l3mdev_ip6_out() may have replaced the skb dst. */
+	rt = dst_rt6_info(skb_dst(skb));
+
 	/* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev
 	 * in the error path. Since skb has been freed, the dst could
 	 * have been queued for deletion.

2.53.0