Please consider backporting upstream 0784d83df3bf to 6.1.y,
6.6.y and 6.12.y. It looks like the missing prerequisite for
dbc3791e3b24 ("net: do not send ICMP/NDISC Redirects when peer
allocation fails") already queued on these trees.

dbc3791e3b24 adds "if (!peer) goto release;" inside
rcu_read_lock()/rcu_read_unlock() in ndisc_send_redirect(),
which seems to leak the read lock on the NULL-peer path on
these trees. This cleanup drops the pair (callers already hold
rcu_read_lock()), so the leak would go away.

The patch below is against 6.12.y; the identical change applies
to 6.1.y and 6.6.y.

Eric Dumazet (1):
  ndisc: ndisc_send_redirect() cleanup

 net/ipv6/ndisc.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

-- 
2.34.1

On Mon, Aug 24, 2026 at 09:38:51PM +0800, Li Xiasong wrote:
> dbc3791e3b24 adds "if (!peer) goto release;" inside
> rcu_read_lock()/rcu_read_unlock() in ndisc_send_redirect(),
> which seems to leak the read lock on the NULL-peer path on
> these trees. This cleanup drops the pair (callers already hold
> rcu_read_lock()), so the leak would go away.

Correct, and confirmed here - ip6_forward() already wraps the call in
rcu_read_lock() on all three trees.

Queued for 6.12, 6.6 and 6.1, thanks.

-- 
Thanks,
Sasha

On Mon, Aug 24, 2026 at 09:38:51PM +0800, Li Xiasong wrote:
> Please consider backporting upstream 0784d83df3bf to 6.1.y,
> 6.6.y and 6.12.y. It looks like the missing prerequisite for
> dbc3791e3b24 ("net: do not send ICMP/NDISC Redirects when peer
> allocation fails") already queued on these trees.
> 
> dbc3791e3b24 adds "if (!peer) goto release;" inside
> rcu_read_lock()/rcu_read_unlock() in ndisc_send_redirect(),
> which seems to leak the read lock on the NULL-peer path on
> these trees. This cleanup drops the pair (callers already hold
> rcu_read_lock()), so the leak would go away.
> 
> The patch below is against 6.12.y; the identical change applies
> to 6.1.y and 6.6.y.

Thanks for noticing this and the backport.