From nobody Tue Feb 10 09:57:10 2026 Received: from mail-pl1-f227.google.com (mail-pl1-f227.google.com [209.85.214.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 172FC31A545 for ; Mon, 19 Jan 2026 11:52:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768823563; cv=none; b=Ot5CUArBKA4MV5vt5kWopoVZWyi+FkG9/Q6dJWTGVH4JoZwFMHX9CTYdJK8n+bT78Tjek2Sz7aaTXWiitwlVy44y4OBLxkWpXLvB8mXi78Vt9rPJuDoRYfqfiJQAhg8bpNNCiPO3a4QlvWgDVyTkPbxrxt8RqSB2w+e0NfJ5b1s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768823563; c=relaxed/simple; bh=7s21PiKqoDI2UWcnusRjQAy1HY+xab4PIu+TPyMO0+E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fHha4Em8SbS2kRclUgdMWjgE/nCa7fKwKehUJvt9cVr6F+VRwEY6GWomw1SwCREAznSRuZFCm+UvCm2OzQImfnCafS6ZoXCn4It7DFWpUsYsZ8qrmD4F6G0Meg40B6vBtCegafulcC8Fq4SP5dpA6xFg+PfUhqvEMXfhZi4QvgY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=V1j/l9jC; arc=none smtp.client-ip=209.85.214.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="V1j/l9jC" Received: by mail-pl1-f227.google.com with SMTP id d9443c01a7336-2a08c65fceeso7324065ad.2 for ; Mon, 19 Jan 2026 03:52:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768823558; x=1769428358; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=N7MKZiatBshCjLhK/wnOMzSh/LSYhDXgYWq/2BVz61M=; b=HDUpTlWTwpp7s+/UbVhFYt+qyK9Pfk01Gbq8W6tJAXVJvBsxQSb68F9fDyQGNsiIV0 bPtcWmPh3kEwRfmoEKDbcQvr/Xv7QuzulnaOZejd3EA4Tz+LS40Jr7Jvg5odrbFCAVbV Yejavh04Bb7csLaYeAbIOG3d4eHUcTEVGBeK2lAQkJFWN8aibxk044DyOgg2b34brI9s 0fb0CsMI87QcdeLJipI3RCLnvK8ojJpUJd1oVBdcNHewuIBPZmSfq+2u4HdO1BV1AHQQ HuI7G3okKp2TNEghy2Qqv+Tt4m9dKwZAt9SNpAXOf99A4rP/kTi5QfpdtyYIXoeB+uBb DTbw== X-Forwarded-Encrypted: i=1; AJvYcCWBk3vnc7lpkuDd0YYaTr3OWxTGeeFhI3B99lMxd56tl9CbdDvxtc+u6mJltAPlskE3FX+HSWZtWBy86bY=@vger.kernel.org X-Gm-Message-State: AOJu0Ywiwe9WzWW6xKP99mLL63Vr9m3j8BDkJ9/HEGlG/Jq7BI6BjOV9 NBxLguLHNNSOfKNcRJbmeIxJLuZi6O7nh9sVdVhYr6MqbMvaYdfEUSPV90E4lCeUUzfpFnWXJsn /wSuUNRJovQ1pMn3JU4KQ04jNm7oP9Nap8rymLRBVcxeQueWDhqPzh7pgxoboeJKFs3ZKFBUvwS xPSmZJ0XICBN2z2OgbBgoZJZnYj9Lt3qWgyHDQjzIhM/ZIofp8uAo7KefooMXd7KepG/6yBuUoM yvJ386otbmiLqsFYLGmt+cbgiaVSLj27bB4ck4= X-Gm-Gg: AZuq6aIgfw3sDau0ItrfAvAix6OZlemJd7QFsKOZCiHiBIBdqG5hzSha0RwD1P6zcvy tCk+375WJn8rKw3QZKVqdKR0sbD7fpDQ1iCVz9sdqSpDDcYjEoNOTjJu7OFfMpde3J5+XNNNXwK u8GXjlOl/u3vWugnvUokGuu8cYMa4fRXq7gLzXPf99SBVj5gqCV6FgXGeFZ1zyiChg/n5w+Zdb1 l71ayAaBWhsCbb3sEGy9wzt8beDNBbKTogLHaFkUDanNjGaa+FUBQAJo2ZLJKnHALULTQuExIQ/ ORXkEOKlkr/aU/WrXmQPvDBN0YXmqFyzC31npnqcD2ax18MVJTb488dgHbIHBG97SHRHuU5h/yI 8KBoko2DJ9iUizWzLHBsN2CT9B0V4+viPXCb8YhLXj2DJ86lVtcLajcoN61yg7qRhJD5DiSzirr RU/MKK4EGhLrbzwVbJf5BT7RMC+1MBo8yr98yq3r/GUsClG3pnta5w4b7lLEDBKw== X-Received: by 2002:a17:903:198c:b0:2a0:d63c:7859 with SMTP id d9443c01a7336-2a71752a9cbmr71940645ad.3.1768823558405; Mon, 19 Jan 2026 03:52:38 -0800 (PST) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-72.dlp.protect.broadcom.com. [144.49.247.72]) by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2a7193ac200sm14871835ad.57.2026.01.19.03.52.38 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Jan 2026 03:52:38 -0800 (PST) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-8c231297839so95683485a.1 for ; Mon, 19 Jan 2026 03:52:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1768823557; x=1769428357; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=N7MKZiatBshCjLhK/wnOMzSh/LSYhDXgYWq/2BVz61M=; b=V1j/l9jC5hw3TTW/oKI/nSloeHMC2DVcjv1xKb+ipq3aDZJqfPQHOlcZfNbiPa5+iM Q+wMHaKo/xq/gbfYOQNa49PY72PBiqsYRuYk+FyaNmiup83i85QpwxcXFmpZq+Ybhxsf jX6aOjo54Qh6DP1QLDGgmS4e0+pfWB0R/38Es= X-Forwarded-Encrypted: i=1; AJvYcCVYqMCNlPeyr6QdO3UbZ+ORY7sVoaQhrvVAiFjFhmXmnrV0gfSbUQl7c0lVn4Yu0heJXVZSW6wn9qZ1POA=@vger.kernel.org X-Received: by 2002:a05:620a:cd0:b0:8c6:a707:dae7 with SMTP id af79cd13be357-8c6a707dafdmr885239985a.1.1768823556975; Mon, 19 Jan 2026 03:52:36 -0800 (PST) X-Received: by 2002:a05:620a:cd0:b0:8c6:a707:dae7 with SMTP id af79cd13be357-8c6a707dafdmr885236885a.1.1768823556365; Mon, 19 Jan 2026 03:52:36 -0800 (PST) Received: from keerthanak-ph5-dev.. ([192.19.161.250]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8c6a71bf2b0sm772878885a.12.2026.01.19.03.52.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Jan 2026 03:52:35 -0800 (PST) From: Keerthana K To: stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, yoshfuji@linux-ipv6.org, dsahern@kernel.org, borisp@nvidia.com, john.fastabend@gmail.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, ajay.kaher@broadcom.com, alexey.makhalov@broadcom.com, vamsi-krishna.brahmajosyula@broadcom.com, yin.ding@broadcom.com, tapas.kundu@broadcom.com, Sharath Chandra Vurukala , Keerthana K Subject: [PATCH v5.15-v6.1 1/2] net: Add locking to protect skb->dev access in ip_output Date: Mon, 19 Jan 2026 11:49:09 +0000 Message-ID: <20260119114910.1414976-2-keerthana.kalyanasundaram@broadcom.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260119114910.1414976-1-keerthana.kalyanasundaram@broadcom.com> References: <20260119114910.1414976-1-keerthana.kalyanasundaram@broadcom.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e Content-Type: text/plain; charset="utf-8" From: Sharath Chandra Vurukala [ Upstream commit 1dbf1d590d10a6d1978e8184f8dfe20af22d680a] In ip_output() skb->dev is updated from the skb_dst(skb)->dev this can become invalid when the interface is unregistered and freed, Introduced new skb_dst_dev_rcu() function to be used instead of skb_dst_dev() within rcu_locks in ip_output.This will ensure that all the skb's associated with the dev being deregistered will be transnmitted out first, before freeing the dev. Given that ip_output() is called within an rcu_read_lock() critical section or from a bottom-half context, it is safe to introduce an RCU read-side critical section within it. Multiple panic call stacks were observed when UL traffic was run in concurrency with device deregistration from different functions, pasting one sample for reference. [496733.627565][T13385] Call trace: [496733.627570][T13385] bpf_prog_ce7c9180c3b128ea_cgroupskb_egres+0x24c/0x7= f0 [496733.627581][T13385] __cgroup_bpf_run_filter_skb+0x128/0x498 [496733.627595][T13385] ip_finish_output+0xa4/0xf4 [496733.627605][T13385] ip_output+0x100/0x1a0 [496733.627613][T13385] ip_send_skb+0x68/0x100 [496733.627618][T13385] udp_send_skb+0x1c4/0x384 [496733.627625][T13385] udp_sendmsg+0x7b0/0x898 [496733.627631][T13385] inet_sendmsg+0x5c/0x7c [496733.627639][T13385] __sys_sendto+0x174/0x1e4 [496733.627647][T13385] __arm64_sys_sendto+0x28/0x3c [496733.627653][T13385] invoke_syscall+0x58/0x11c [496733.627662][T13385] el0_svc_common+0x88/0xf4 [496733.627669][T13385] do_el0_svc+0x2c/0xb0 [496733.627676][T13385] el0_svc+0x2c/0xa4 [496733.627683][T13385] el0t_64_sync_handler+0x68/0xb4 [496733.627689][T13385] el0t_64_sync+0x1a4/0x1a8 Changes in v3: - Replaced WARN_ON() with WARN_ON_ONCE(), as suggested by Willem de Bruijn. - Dropped legacy lines mistakenly pulled in from an outdated branch. Changes in v2: - Addressed review comments from Eric Dumazet - Used READ_ONCE() to prevent potential load/store tearing - Added skb_dst_dev_rcu() and used along with rcu_read_lock() in ip_output Signed-off-by: Sharath Chandra Vurukala Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250730105118.GA26100@hu-sharathv-hyd.qualc= omm.com Signed-off-by: Jakub Kicinski [ Keerthana: Backported the patch to v5.15-v6.1 ] Signed-off-by: Keerthana K --- include/net/dst.h | 12 ++++++++++++ net/ipv4/ip_output.c | 16 +++++++++++----- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/include/net/dst.h b/include/net/dst.h index 3a1a6f94a..20a76e532 100644 --- a/include/net/dst.h +++ b/include/net/dst.h @@ -555,6 +555,18 @@ static inline void skb_dst_update_pmtu_no_confirm(stru= ct sk_buff *skb, u32 mtu) dst->ops->update_pmtu(dst, NULL, skb, mtu, false); } =20 +static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst) +{ + /* In the future, use rcu_dereference(dst->dev) */ + WARN_ON_ONCE(!rcu_read_lock_held()); + return READ_ONCE(dst->dev); +} + +static inline struct net_device *skb_dst_dev_rcu(const struct sk_buff *skb) +{ + return dst_dev_rcu(skb_dst(skb)); +} + struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, bool confirm_neigh); diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 543d02910..79cf1385e 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -420,17 +420,23 @@ int ip_mc_output(struct net *net, struct sock *sk, st= ruct sk_buff *skb) =20 int ip_output(struct net *net, struct sock *sk, struct sk_buff *skb) { - struct net_device *dev =3D skb_dst(skb)->dev, *indev =3D skb->dev; + struct net_device *dev, *indev =3D skb->dev; + int ret_val; + + rcu_read_lock(); + dev =3D skb_dst_dev_rcu(skb); =20 IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len); =20 skb->dev =3D dev; skb->protocol =3D htons(ETH_P_IP); =20 - return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, - net, sk, skb, indev, dev, - ip_finish_output, - !(IPCB(skb)->flags & IPSKB_REROUTED)); + ret_val =3D NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, + net, sk, skb, indev, dev, + ip_finish_output, + !(IPCB(skb)->flags & IPSKB_REROUTED)); + rcu_read_unlock(); + return ret_val; } EXPORT_SYMBOL(ip_output); =20 --=20 2.43.7