From nobody Sat Sep 26 14:40:04 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB1FC476CE6; Mon, 31 Aug 2026 16:06:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192401; cv=none; b=dsGBRejyiZELSyC+VX/1x/WuPPOkR1pRBaN7pYMrOcmiqorrlv+wCYDvAGdCj9bLfTNqYKx0cuZ2vw3uZp0BXb8Liuehvu4hvl8aFLUJ8F2/+DBbpM3gd5dha1CSwcgmFRf471eAHyj39svqjeF22xdKC/C8yMkHglR9N2jspos= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192401; c=relaxed/simple; bh=GYDmoSQopi8JIbV5HKMnY3p2XfPPSGecnpYA5BQJ3QY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ibGs0J9GmeiHxANnveTm6AOEyqn+dAKnEwhEYhp4X2sfcBwx9WfOAf07GuO48eQWlDqSXVuRcQJVyzBcslc7hw/+X5jW51Rd9mt5VFsr+RJ6oimj23Gj4TASoJ01IrfgqWMgtHEmwcXm2or9btb/GrWjJHwqWo0GoND869c7iVo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=Y65tNXqd; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="Y65tNXqd" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 6AB554E41474; Mon, 31 Aug 2026 16:06:37 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 3ED4F60231; Mon, 31 Aug 2026 16:06:37 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id A701811C791C9; Mon, 31 Aug 2026 18:06:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788192396; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=1b9ggnS+m9DvxvjCyGwQo1Po6c1ljpGIbGBtA5dENFE=; b=Y65tNXqdSjiqIvjCM9PSzRcTLVqVmEJYv1UMzeLJ0CG6/o1WzW39OOYS4G4BQwVbEGKGEV Xqe/9BNERUA2i+WCDCnFcjy9jfRVf5NKJb9v1Ar86YgFyOpXvNBWO6H1xfWCvKvaCRl9GO HmpnBL9obWC4uhqTj1Gq5Rcpm7Aj8NWJx98msapDZzS87XBlW/p25mGH9Qzeky8rXIKLLL IphBhSofxMb+pLBTCneZC6aY3fG55UV6u8Dml1OOlvIUREkDdVHvPpUzt68ZOt+wHkrDXA d8x/lsQKbi15n9/f8MXskF2X9fiWuQ0JAxCPQK0FD8qC9ZExtCfefQrnFBLcSw== From: "Miguel Gazquez (Schneider Electric)" Date: Mon, 31 Aug 2026 18:06:20 +0200 Subject: [PATCH 6.6.y 1/4] net: dst: add four helpers to annotate data-races around dst->dev Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260831-cve-2025-40074-6-6-v1-1-027e51b162a3@bootlin.com> References: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> In-Reply-To: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> To: stable@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Martin KaFai Lau , Wei Wang , David Ahern , Steffen Klassert , Herbert Xu , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal Cc: Thomas Petazzoni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, "Miguel Gazquez (Schneider Electric)" , Kuniyuki Iwashima X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788192387; l=4931; i=miguel.gazquez@bootlin.com; s=20250708; h=from:subject:message-id; bh=dVsZJnIS1AfxVNrteL10XJDu1yEepAsiZ9WjggoUgfg=; b=JVVQZYdWwY25eL9D+KKtayQaaDYBJGBeb8Nq9ivTZZWwggGkBNDuEdcloPeGBwyrtV8eMSvGE b62Ac00B5kpDZhxQFsotPTY+oR3O7eoS8ESbv8gYJfun4zdlaoBpuXE X-Developer-Key: i=miguel.gazquez@bootlin.com; a=ed25519; pk=k/2KI9jkmayaF0ghZ8QYUH9Wm/kFHDhl8QoZ0RHbr4w= X-Last-TLS-Session-Version: TLSv1.3 From: Eric Dumazet [ Upstream commit 88fe14253e181878c2ddb51a298ae8c468a63010 ] dst->dev is read locklessly in many contexts, and written in dst_dev_put(). Fixing all the races is going to need many changes. We probably will have to add full RCU protection. Add three helpers to ease this painful process. static inline struct net_device *dst_dev(const struct dst_entry *dst) { return READ_ONCE(dst->dev); } static inline struct net_device *skb_dst_dev(const struct sk_buff *skb) { return dst_dev(skb_dst(skb)); } static inline struct net *skb_dst_dev_net(const struct sk_buff *skb) { return dev_net(skb_dst_dev(skb)); } static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb) { return dev_net_rcu(skb_dst_dev(skb)); } Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-7-edumazet@google.com Signed-off-by: Jakub Kicinski [ minor modifications to fix conflict ] Signed-off-by: Miguel Gazquez (Schneider Electric) --- include/net/dst.h | 20 ++++++++++++++++++++ net/core/dst.c | 4 ++-- net/core/sock.c | 8 ++++---- 3 files changed, 26 insertions(+), 6 deletions(-) diff --git a/include/net/dst.h b/include/net/dst.h index 55d1be268d24..1983945dfcdf 100644 --- a/include/net/dst.h +++ b/include/net/dst.h @@ -569,6 +569,11 @@ static inline void skb_dst_update_pmtu_no_confirm(stru= ct sk_buff *skb, u32 mtu) dst->ops->update_pmtu(dst, NULL, skb, mtu, false); } =20 +static inline struct net_device *dst_dev(const struct dst_entry *dst) +{ + return READ_ONCE(dst->dev); +} + static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst) { /* In the future, use rcu_dereference(dst->dev) */ @@ -576,11 +581,26 @@ static inline struct net_device *dst_dev_rcu(const st= ruct dst_entry *dst) return READ_ONCE(dst->dev); } =20 +static inline struct net_device *skb_dst_dev(const struct sk_buff *skb) +{ + return dst_dev(skb_dst(skb)); +} + static inline struct net_device *skb_dst_dev_rcu(const struct sk_buff *skb) { return dst_dev_rcu(skb_dst(skb)); } =20 +static inline struct net *skb_dst_dev_net(const struct sk_buff *skb) +{ + return dev_net(skb_dst_dev(skb)); +} + +static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb) +{ + return dev_net_rcu(skb_dst_dev(skb)); +} + struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb, u32 mtu, bool confirm_neigh); diff --git a/net/core/dst.c b/net/core/dst.c index 5ed8cb10748f..f65e6be7e257 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -153,7 +153,7 @@ void dst_dev_put(struct dst_entry *dst) dst->ops->ifdown(dst, dev); WRITE_ONCE(dst->input, dst_discard); WRITE_ONCE(dst->output, dst_discard_out); - dst->dev =3D blackhole_netdev; + WRITE_ONCE(dst->dev, blackhole_netdev); netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker, GFP_ATOMIC); } @@ -266,7 +266,7 @@ unsigned int dst_blackhole_mtu(const struct dst_entry *= dst) { unsigned int mtu =3D dst_metric_raw(dst, RTAX_MTU); =20 - return mtu ? : dst->dev->mtu; + return mtu ? : dst_dev(dst)->mtu; } EXPORT_SYMBOL_GPL(dst_blackhole_mtu); =20 diff --git a/net/core/sock.c b/net/core/sock.c index 846e95805c19..2f82dc45f93e 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2454,8 +2454,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struc= t dst_entry *dst) !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)); #endif /* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */ - max_size =3D is_ipv6 ? READ_ONCE(dst->dev->gso_max_size) : - READ_ONCE(dst->dev->gso_ipv4_max_size); + max_size =3D is_ipv6 ? READ_ONCE(dst_dev(dst)->gso_max_size) : + READ_ONCE(dst_dev(dst)->gso_ipv4_max_size); if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk)) max_size =3D GSO_LEGACY_MAX_SIZE; =20 @@ -2466,7 +2466,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry = *dst) { u32 max_segs =3D 1; =20 - sk->sk_route_caps =3D dst->dev->features; + sk->sk_route_caps =3D dst_dev(dst)->features; if (sk_is_tcp(sk)) sk->sk_route_caps |=3D NETIF_F_GSO; if (sk->sk_route_caps & NETIF_F_GSO) @@ -2480,7 +2480,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry = *dst) sk->sk_route_caps |=3D NETIF_F_SG | NETIF_F_HW_CSUM; sk->sk_gso_max_size =3D sk_dst_gso_max_size(sk, dst); /* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */ - max_segs =3D max_t(u32, READ_ONCE(dst->dev->gso_max_segs), 1); + max_segs =3D max_t(u32, READ_ONCE(dst_dev(dst)->gso_max_segs), 1); } } sk->sk_gso_max_segs =3D max_segs; --=20 2.55.0 From nobody Sat Sep 26 14:40:04 2026 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5E9F4779AA for ; Mon, 31 Aug 2026 16:06:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192403; cv=none; b=iamko10+2avZlNNWLAhW051wFsr/V2Y0Oj8sdCdPSM3raYs6pV1qESX110BdrEDxVBNYYKp8QD6q6iqradKtFmleOZru8mOA+G0CNuX9Krbcir7o6qq1bc+ZZqHF8W+d35Xn1X4jadYRPzEde7n4yCqMsXCn7lzvhFvqatCDtTM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192403; c=relaxed/simple; bh=mfZaWwTA0R2KmCm4fOqEJA3oAp3CDY7e4VRESDSh9kE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lT93Pk14XWdjr3vi8xTAhFJP7NfzYaalOErCh7mLFq2zZRkPCv6xpSkt+7IdUWMDJqW/em4vQRowz47zaMNElBXhHpHBWCnmqG360AmIGe9+CM6yeBNp6W4mmcdhEyQum5egutU1WEG7XV1w4YqM8PaspMzhCbzFU2DJisdaP4w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=2ZlPiXNN; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="2ZlPiXNN" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 3C7471A1909; Mon, 31 Aug 2026 16:06:39 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 0811160231; Mon, 31 Aug 2026 16:06:39 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 8198711C78B96; Mon, 31 Aug 2026 18:06:36 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788192398; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=JEJ1uhUFqV6G4Uf8bVvW+BruDxKnhgyJ2Y6JOmXEK70=; b=2ZlPiXNNipmGCy9TaxqM336K7rHIPI7Kt8wkW+GQPBD5qEq9HGT5syl4laUiIS5koiHdpA zS5mUJOcLoKYNruLN+QxikxEUZx0jOq2T/X9ILea+y7xzNqB9IStcp1rCC+mXZOzjB9Ofj monu/tvVU9k8ialufJYHH6AMAH9LbWc+oA5mX+z8WNPd3uD7gZIh88AdpkAxPVHT1kIIHC cRRoRW/LM6nj2m9f3S6tI3JAqfMEiCjwsWgrccnXCETxfSLWvih1ALa4OCQZ7LPCrCsVmq cxXgiG1z8txMpMkpnhkcyE+V3ynNNhsMziAItG5DSQrog8q7Mr/jQi6ZLIYlRg== From: "Miguel Gazquez (Schneider Electric)" Date: Mon, 31 Aug 2026 18:06:21 +0200 Subject: [PATCH 6.6.y 2/4] ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260831-cve-2025-40074-6-6-v1-2-027e51b162a3@bootlin.com> References: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> In-Reply-To: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> To: stable@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Martin KaFai Lau , Wei Wang , David Ahern , Steffen Klassert , Herbert Xu , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal Cc: Thomas Petazzoni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, "Miguel Gazquez (Schneider Electric)" , Kuniyuki Iwashima X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788192387; l=14378; i=miguel.gazquez@bootlin.com; s=20250708; h=from:subject:message-id; bh=wF2QPjBS5wdN+AisRnim+T100qCdVqqYDXpsxDEltao=; b=IKmSSf+xLT4To8O1zEAKoSsyQ0MkaXbfimRFEVW17drbo03OXGZ6kxrg0AlTHSDYtQMTnF5B/ poUnKS1CdcLCePX59rF7zdZpqN3wljZHMCCPjlk8FU8sT6hllYYqTYQ X-Developer-Key: i=miguel.gazquez@bootlin.com; a=ed25519; pk=k/2KI9jkmayaF0ghZ8QYUH9Wm/kFHDhl8QoZ0RHbr4w= X-Last-TLS-Session-Version: TLSv1.3 From: Eric Dumazet [ Upstream commit a74fc62eec155ca5a6da8ff3856f3dc87fe24558 ] Use the new helpers as a first step to deal with potential dst->dev races. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-8-edumazet@google.com Signed-off-by: Jakub Kicinski [ minor modifications to fix conflict ] Signed-off-by: Miguel Gazquez (Schneider Electric) --- include/net/inet_hashtables.h | 2 +- include/net/ip.h | 11 ++++++----- include/net/route.h | 2 +- net/ipv4/icmp.c | 24 +++++++++++++----------- net/ipv4/igmp.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 4 ++-- net/ipv4/ip_vti.c | 4 ++-- net/ipv4/netfilter.c | 4 ++-- net/ipv4/route.c | 8 ++++---- net/ipv4/tcp_fastopen.c | 4 +++- net/ipv4/tcp_ipv4.c | 3 ++- net/ipv4/tcp_metrics.c | 8 ++++---- net/ipv4/xfrm4_output.c | 2 +- 14 files changed, 43 insertions(+), 37 deletions(-) diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h index 8eeb3708f20b..21119e962f00 100644 --- a/include/net/inet_hashtables.h +++ b/include/net/inet_hashtables.h @@ -511,7 +511,7 @@ static inline struct sock *__inet_lookup_skb(struct ine= t_hashinfo *hashinfo, const int sdif, bool *refcounted) { - struct net *net =3D dev_net(skb_dst(skb)->dev); + struct net *net =3D skb_dst_dev_net(skb); const struct iphdr *iph =3D ip_hdr(skb); struct sock *sk; =20 diff --git a/include/net/ip.h b/include/net/ip.h index bacdb4fecc89..f66dd581ba83 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -458,7 +458,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(con= st struct dst_entry *dst, bool forwarding) { const struct rtable *rt =3D container_of(dst, struct rtable, dst); - struct net *net =3D dev_net(dst->dev); + struct net *net =3D dev_net(dst_dev(dst)); unsigned int mtu; =20 if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) || @@ -474,7 +474,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(con= st struct dst_entry *dst, if (mtu) goto out; =20 - mtu =3D READ_ONCE(dst->dev->mtu); + mtu =3D READ_ONCE(dst_dev(dst)->mtu); =20 if (unlikely(ip_mtu_locked(dst))) { if (rt->rt_uses_gateway && mtu > 576) @@ -490,16 +490,17 @@ static inline unsigned int ip_dst_mtu_maybe_forward(c= onst struct dst_entry *dst, static inline unsigned int ip_skb_dst_mtu(struct sock *sk, const struct sk_buff *skb) { + const struct dst_entry *dst =3D skb_dst(skb); unsigned int mtu; =20 if (!sk || !sk_fullsock(sk) || ip_sk_use_pmtu(sk)) { bool forwarding =3D IPCB(skb)->flags & IPSKB_FORWARDED; =20 - return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding); + return ip_dst_mtu_maybe_forward(dst, forwarding); } =20 - mtu =3D min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); - return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); + mtu =3D min(READ_ONCE(dst_dev(dst)->mtu), IP_MAX_MTU); + return mtu - lwtunnel_headroom(dst->lwtstate, mtu); } =20 struct dst_metrics *ip_fib_metrics_init(struct nlattr *fc_mx, int fc_mx_le= n, diff --git a/include/net/route.h b/include/net/route.h index 1d5d975c1707..d443de683628 100644 --- a/include/net/route.h +++ b/include/net/route.h @@ -359,7 +359,7 @@ static inline int ip4_dst_hoplimit(const struct dst_ent= ry *dst) const struct net *net; =20 rcu_read_lock(); - net =3D dev_net_rcu(dst->dev); + net =3D dev_net_rcu(dst_dev(dst)); hoplimit =3D READ_ONCE(net->ipv4.sysctl_ip_default_ttl); rcu_read_unlock(); } diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 7c4c7b7fe384..f0c8c3366740 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -313,18 +313,20 @@ static bool icmpv4_xrlim_allow(struct net *net, struc= t rtable *rt, { struct dst_entry *dst =3D &rt->dst; struct inet_peer *peer; + struct net_device *dev; bool rc =3D true; =20 if (!apply_ratelimit) return true; =20 /* No rate limit on loopback */ - if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) + dev =3D dst_dev(dst); + if (dev && (dev->flags & IFF_LOOPBACK)) goto out; =20 rcu_read_lock(); peer =3D inet_getpeer_v4(net->ipv4.peers, fl4->daddr, - l3mdev_master_ifindex_rcu(dst->dev)); + l3mdev_master_ifindex_rcu(dev)); rc =3D inet_peer_xrlim_allow(peer, READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); rcu_read_unlock(); @@ -472,13 +474,13 @@ static void icmp_reply(struct icmp_bxm *icmp_param, s= truct sk_buff *skb) */ static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) { - struct net_device *route_lookup_dev =3D NULL; + struct net_device *dev =3D skb->dev; + const struct dst_entry *dst; =20 - if (skb->dev) - route_lookup_dev =3D skb->dev; - else if (skb_dst(skb)) - route_lookup_dev =3D skb_dst(skb)->dev; - return route_lookup_dev; + if (dev) + return dev; + dst =3D skb_dst(skb); + return dst ? dst_dev(dst) : NULL; } =20 static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl= 4, @@ -911,7 +913,7 @@ static enum skb_drop_reason icmp_unreach(struct sk_buff= *skb) struct net *net; u32 info =3D 0; =20 - net =3D dev_net_rcu(skb_dst(skb)->dev); + net =3D skb_dst_dev_net_rcu(skb); =20 /* * Incomplete header ? @@ -1054,7 +1056,7 @@ static enum skb_drop_reason icmp_echo(struct sk_buff = *skb) struct icmp_bxm icmp_param; struct net *net; =20 - net =3D dev_net_rcu(skb_dst(skb)->dev); + net =3D skb_dst_dev_net_rcu(skb); /* should there be an ICMP stat for ignored echos? */ if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all)) return SKB_NOT_DROPPED_YET; @@ -1231,7 +1233,7 @@ static enum skb_drop_reason icmp_timestamp(struct sk_= buff *skb) return SKB_NOT_DROPPED_YET; =20 out_err: - __ICMP_INC_STATS(dev_net_rcu(skb_dst(skb)->dev), ICMP_MIB_INERRORS); + __ICMP_INC_STATS(skb_dst_dev_net_rcu(skb), ICMP_MIB_INERRORS); return SKB_DROP_REASON_PKT_TOO_SMALL; } =20 diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 732804f3a0aa..8509e9473834 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -428,7 +428,7 @@ static int igmpv3_sendpack(struct sk_buff *skb) =20 pig->csum =3D ip_compute_csum(igmp_hdr(skb), igmplen); =20 - return ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb); + return ip_local_out(skb_dst_dev_net(skb), skb->sk, skb); } =20 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel) diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 8524f2ac2cf3..46b84d029205 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -470,7 +470,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff= *skb, /* Process an incoming IP datagram fragment. */ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) { - struct net_device *dev =3D skb->dev ? : skb_dst(skb)->dev; + struct net_device *dev =3D skb->dev ? : skb_dst_dev(skb); int vif =3D l3mdev_master_ifindex_rcu(dev); struct ipq *qp; =20 diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 150cdea8aacb..3bb198b2c101 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -116,7 +116,7 @@ int __ip_local_out(struct net *net, struct sock *sk, st= ruct sk_buff *skb) skb->protocol =3D htons(ETH_P_IP); =20 return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, - net, sk, skb, NULL, skb_dst(skb)->dev, + net, sk, skb, NULL, skb_dst_dev(skb), dst_output); } =20 @@ -199,7 +199,7 @@ static int ip_finish_output2(struct net *net, struct so= ck *sk, struct sk_buff *s { struct dst_entry *dst =3D skb_dst(skb); struct rtable *rt =3D (struct rtable *)dst; - struct net_device *dev =3D dst->dev; + struct net_device *dev =3D dst_dev(dst); unsigned int hh_len =3D LL_RESERVED_SPACE(dev); struct neighbour *neigh; bool is_v6gw =3D false; diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c index 02744447e435..cd61a417c44d 100644 --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c @@ -226,7 +226,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct= net_device *dev, goto tx_error_icmp; } =20 - tdev =3D dst->dev; + tdev =3D dst_dev(dst); =20 if (tdev =3D=3D dev) { dst_release(dst); @@ -256,7 +256,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct= net_device *dev, xmit: skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev))); skb_dst_set(skb, dst); - skb->dev =3D skb_dst(skb)->dev; + skb->dev =3D skb_dst_dev(skb); =20 err =3D dst_output(tunnel->net, skb->sk, skb); if (net_xmit_eval(err) =3D=3D 0) diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c index bd135165482a..c450509d6efd 100644 --- a/net/ipv4/netfilter.c +++ b/net/ipv4/netfilter.c @@ -19,12 +19,12 @@ /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queu= e */ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *s= kb, unsigned int addr_type) { + struct net_device *dev =3D skb_dst_dev(skb); const struct iphdr *iph =3D ip_hdr(skb); struct rtable *rt; struct flowi4 fl4 =3D {}; __be32 saddr =3D iph->saddr; __u8 flags; - struct net_device *dev =3D skb_dst(skb)->dev; struct flow_keys flkeys; unsigned int hh_len; =20 @@ -73,7 +73,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, = struct sk_buff *skb, un #endif =20 /* Change in oif may mean change in hh_len. */ - hh_len =3D skb_dst(skb)->dev->hard_header_len; + hh_len =3D skb_dst_dev(skb)->hard_header_len; if (skb_headroom(skb) < hh_len && pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)), 0, GFP_ATOMIC)) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 789953096c80..5010a9a75418 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -416,7 +416,7 @@ static struct neighbour *ipv4_neigh_lookup(const struct= dst_entry *dst, const void *daddr) { const struct rtable *rt =3D container_of(dst, struct rtable, dst); - struct net_device *dev =3D dst->dev; + struct net_device *dev =3D dst_dev(dst); struct neighbour *n; =20 rcu_read_lock(); @@ -443,7 +443,7 @@ static struct neighbour *ipv4_neigh_lookup(const struct= dst_entry *dst, static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *da= ddr) { const struct rtable *rt =3D container_of(dst, struct rtable, dst); - struct net_device *dev =3D dst->dev; + struct net_device *dev =3D dst_dev(dst); const __be32 *pkey =3D daddr; =20 if (rt->rt_gw_family =3D=3D AF_INET) { @@ -1069,7 +1069,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, st= ruct flowi4 *fl4, u32 mtu) return; =20 rcu_read_lock(); - net =3D dev_net_rcu(dst->dev); + net =3D dev_net_rcu(dst_dev(dst)); if (mtu < net->ipv4.ip_rt_min_pmtu) { lock =3D true; mtu =3D min(old_mtu, net->ipv4.ip_rt_min_pmtu); @@ -1367,7 +1367,7 @@ static unsigned int ipv4_default_advmss(const struct = dst_entry *dst) struct net *net; =20 rcu_read_lock(); - net =3D dev_net_rcu(dst->dev); + net =3D dev_net_rcu(dst_dev(dst)); advmss =3D max_t(unsigned int, ipv4_mtu(dst) - header_size, net->ipv4.ip_rt_min_advmss); rcu_read_unlock(); diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index 408985eb74ee..86c995dc1c5e 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c @@ -558,6 +558,7 @@ bool tcp_fastopen_active_should_disable(struct sock *sk) void tcp_fastopen_active_disable_ofo_check(struct sock *sk) { struct tcp_sock *tp =3D tcp_sk(sk); + struct net_device *dev; struct dst_entry *dst; struct sk_buff *skb; =20 @@ -575,7 +576,8 @@ void tcp_fastopen_active_disable_ofo_check(struct sock = *sk) } else if (tp->syn_fastopen_ch && atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) { dst =3D sk_dst_get(sk); - if (!(dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))) + dev =3D dst ? dst_dev(dst) : NULL; + if (!(dev && (dev->flags & IFF_LOOPBACK))) atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0); dst_release(dst); } diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 3f9e1cfde008..3055478860c1 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -732,7 +732,8 @@ static void tcp_v4_send_reset(const struct sock *sk, st= ruct sk_buff *skb) arg.iov[0].iov_base =3D (unsigned char *)&rep; arg.iov[0].iov_len =3D sizeof(rep.th); =20 - net =3D sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev); + net =3D sk ? sock_net(sk) : skb_dst_dev_net(skb); + #ifdef CONFIG_TCP_MD5SIG rcu_read_lock(); hash_location =3D tcp_parse_md5sig_option(th); diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index e0883ba709b0..49983d864e4f 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -166,11 +166,11 @@ static struct tcp_metrics_block *tcpm_new(struct dst_= entry *dst, unsigned int hash) { struct tcp_metrics_block *tm; - struct net *net; bool reclaim =3D false; + struct net *net; =20 spin_lock_bh(&tcp_metrics_lock); - net =3D dev_net(dst->dev); + net =3D dev_net(dst_dev(dst)); =20 /* While waiting for the spin-lock the cache might have been populated * with this entry and so we have to check again. @@ -273,7 +273,7 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(= struct request_sock *req, return NULL; } =20 - net =3D dev_net(dst->dev); + net =3D dev_net(dst_dev(dst)); hash ^=3D net_hash_mix(net); hash =3D hash_32(hash, tcp_metrics_hash_log); =20 @@ -318,7 +318,7 @@ static struct tcp_metrics_block *tcp_get_metrics(struct= sock *sk, else return NULL; =20 - net =3D dev_net(dst->dev); + net =3D dev_net(dst_dev(dst)); hash ^=3D net_hash_mix(net); hash =3D hash_32(hash, tcp_metrics_hash_log); =20 diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c index 3cff51ba72bb..0ae67d537499 100644 --- a/net/ipv4/xfrm4_output.c +++ b/net/ipv4/xfrm4_output.c @@ -31,7 +31,7 @@ static int __xfrm4_output(struct net *net, struct sock *s= k, struct sk_buff *skb) int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb) { return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, - net, sk, skb, skb->dev, skb_dst(skb)->dev, + net, sk, skb, skb->dev, skb_dst_dev(skb), __xfrm4_output, !(IPCB(skb)->flags & IPSKB_REROUTED)); } --=20 2.55.0 From nobody Sat Sep 26 14:40:04 2026 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 627E847A0D7; Mon, 31 Aug 2026 16:06:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192404; cv=none; b=o66iuOCJsVu7i2O0jjri+LA0jVQPVV6UQoXuYvYjNtdKRRN+yVNOOrOaedL+laDWYc5c06ydh0Q1uePkNUur5CJmgOC6YD8fVV0aOANKrnhC5r3iB42a+ybZEGSIQGt0vRb5Muf2I/oS1q3FHJL0fHWnHWrlDRgo9l+hsMlxnaM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192404; c=relaxed/simple; bh=yWDdDrKDq21kLtNlvG89pQvPgzrE7uMbjWOKWVhjQuY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=MjqAg//1iU/o9NGNvXUksthF+7vZoDPPZQ54UcXWwOooURK7G9H0mnozqibWg7VWtzNMtvKmwhtSS7WcSgUfS6QH1sDSw0s4ixnCjyggNkQWt8bI8VNPoaRqz9PskD3Eo+5gxljp18cAepeSBR3puLo+EZMywYQXTTladfbj2io= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=FN88P4Hd; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="FN88P4Hd" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id E2A6D1A190B; Mon, 31 Aug 2026 16:06:40 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id B5D9C60231; Mon, 31 Aug 2026 16:06:40 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 5524A11C78AC8; Mon, 31 Aug 2026 18:06:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788192399; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=GQrHdPAdNDpoOwtEj8ExxEJvXwjQocxbzuHQC12oy+0=; b=FN88P4HdSJsBT0VEH3XAc5fpnbfQUUTPOTl+1ni6HrEq57e9M6MTPlBFMSempfQMehC6V8 yNYCPOLqjPdydS6vBG8hK6BGU/yORqpH0iVvD6llf/974iLbRZ4h/JGvaGBq4l57bJIOkd qjL3yxil6XmBxZxMykXlEMv6aBL+QueHdI7zwUh90aDEA0e9aHsP0/WRcdoA/Dci1CIoma WRQFM5xrRpzdoTn/6vEO5onY2E90IS+BS+p5aP5Iq9QuU0DXWqYJpM7dyjRye0c7NJ5/j+ +oHqhFWcPWXswznXGpYM6D7ZETj2fKzXH+CBL3jKkAulHxh0cb9ED2eQCKYYVQ== From: "Miguel Gazquez (Schneider Electric)" Date: Mon, 31 Aug 2026 18:06:22 +0200 Subject: [PATCH 6.6.y 3/4] net: dst: introduce dst->dev_rcu Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260831-cve-2025-40074-6-6-v1-3-027e51b162a3@bootlin.com> References: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> In-Reply-To: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> To: stable@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Martin KaFai Lau , Wei Wang , David Ahern , Steffen Klassert , Herbert Xu , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal Cc: Thomas Petazzoni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, "Miguel Gazquez (Schneider Electric)" X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788192387; l=3480; i=miguel.gazquez@bootlin.com; s=20250708; h=from:subject:message-id; bh=8k+v7v7++iJ5ldUykF05sg7PAEHbGXVludxh/gM9SS0=; b=ObHRv1mUyl8J8MD8WzJvYSyZTuejqi86NKS0kgyadSPbt3jVM6ZH+VVs7XY4BOyoM1P0olAeh 00iQqBPhj2fCcLhY2mS3WhrH1AfFWlzAfDTk58wBIJR4q3WbqKs3A1A X-Developer-Key: i=miguel.gazquez@bootlin.com; a=ed25519; pk=k/2KI9jkmayaF0ghZ8QYUH9Wm/kFHDhl8QoZ0RHbr4w= X-Last-TLS-Session-Version: TLSv1.3 From: Eric Dumazet [ Upstream commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 ] Followup of commit 88fe14253e18 ("net: dst: add four helpers to annotate data-races around dst->dev"). We want to gradually add explicit RCU protection to dst->dev, including lockdep support. Add an union to alias dst->dev_rcu and dst->dev. Add dst_dev_net_rcu() helper. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-2-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Miguel Gazquez (Schneider Electric) --- include/net/dst.h | 16 +++++++++++----- net/core/dst.c | 2 +- net/ipv4/route.c | 4 ++-- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/include/net/dst.h b/include/net/dst.h index 1983945dfcdf..4b54b2f6730e 100644 --- a/include/net/dst.h +++ b/include/net/dst.h @@ -24,7 +24,10 @@ struct sk_buff; =20 struct dst_entry { - struct net_device *dev; + union { + struct net_device *dev; + struct net_device __rcu *dev_rcu; + }; struct dst_ops *ops; unsigned long _metrics; unsigned long expires; @@ -576,9 +579,12 @@ static inline struct net_device *dst_dev(const struct = dst_entry *dst) =20 static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst) { - /* In the future, use rcu_dereference(dst->dev) */ - WARN_ON_ONCE(!rcu_read_lock_held()); - return READ_ONCE(dst->dev); + return rcu_dereference(dst->dev_rcu); +} + +static inline struct net *dst_dev_net_rcu(const struct dst_entry *dst) +{ + return dev_net_rcu(dst_dev_rcu(dst)); } =20 static inline struct net_device *skb_dst_dev(const struct sk_buff *skb) @@ -598,7 +604,7 @@ static inline struct net *skb_dst_dev_net(const struct = sk_buff *skb) =20 static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb) { - return dev_net_rcu(skb_dst_dev(skb)); + return dev_net_rcu(skb_dst_dev_rcu(skb)); } =20 struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie); diff --git a/net/core/dst.c b/net/core/dst.c index f65e6be7e257..46cafba29991 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -153,7 +153,7 @@ void dst_dev_put(struct dst_entry *dst) dst->ops->ifdown(dst, dev); WRITE_ONCE(dst->input, dst_discard); WRITE_ONCE(dst->output, dst_discard_out); - WRITE_ONCE(dst->dev, blackhole_netdev); + rcu_assign_pointer(dst->dev_rcu, blackhole_netdev); netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker, GFP_ATOMIC); } diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 5010a9a75418..ce3397583b8f 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1069,7 +1069,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, st= ruct flowi4 *fl4, u32 mtu) return; =20 rcu_read_lock(); - net =3D dev_net_rcu(dst_dev(dst)); + net =3D dst_dev_net_rcu(dst); if (mtu < net->ipv4.ip_rt_min_pmtu) { lock =3D true; mtu =3D min(old_mtu, net->ipv4.ip_rt_min_pmtu); @@ -1367,7 +1367,7 @@ static unsigned int ipv4_default_advmss(const struct = dst_entry *dst) struct net *net; =20 rcu_read_lock(); - net =3D dev_net_rcu(dst_dev(dst)); + net =3D dst_dev_net_rcu(dst); advmss =3D max_t(unsigned int, ipv4_mtu(dst) - header_size, net->ipv4.ip_rt_min_advmss); rcu_read_unlock(); --=20 2.55.0 From nobody Sat Sep 26 14:40:04 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5985E42E007; Mon, 31 Aug 2026 16:06:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192406; cv=none; b=qIToEMg5SG0RI67Jphy5MeJlaMnQVbtCj4yvH30h3DGxXYI55Ewifp6xgZfTuqM7OpbeYiCWT7tyKwwI9nyKAKk3W0znNhrxQ5vvc+8ahfahT9lQkpx7CKXIx3eGJC8nzJxzoEh6LX2nQfqZrzxkBy+NOBid7qPia6FEcoxok+s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788192406; c=relaxed/simple; bh=FX8YRA5w1FTm8TXCoN14fTaM+KZeJ6SabVYYn8ZuTuQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Au6M1lpjPLs8xT3Sj/ESB7H8S0dKTmL2BleiRDobsSxf2OX0ZQUSRyTHEbOShfKBdqcX+KCf1uxFDGELagF5vIzcQJfOLxFg+KMtVC/pOddJS9+YOgR2hFUMEsduCx2HIzSSZZZlAfJ8gpUSbTg+ApTIVfrnJyFQiVofflPWUh0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=ZZlZCHz1; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="ZZlZCHz1" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id B43DC4E4147F; Mon, 31 Aug 2026 16:06:42 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 813BE60231; Mon, 31 Aug 2026 16:06:42 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id E87B611C791C9; Mon, 31 Aug 2026 18:06:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788192401; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=FyXT90TH3izWaLD5OpCs3DkPlTbCODQkG/eyhvU7/c4=; b=ZZlZCHz1Pnlr90jE1csn2KGUb0I4NgdaAeZtz3kLOAoUVfXwHuhYdoJ1e/ymm3wEGiKshc NqmwOhPgX4FqPn8+VC0UhCZkcwHsw5gD6ermH9Uim/A3TfCmrtJEakBbYzk+7NE7YbtEaa xODRBQUOORM7PAKeu6B+V+kwiSf3PreyZp0P6EMNDomQc2Ss4BelEkr0L7guDq/LysQ7kG VBQIpHPCqcDJMxahOxKuDa+hHs6VpIo2n5VS8kanEBwWFSJBHkNXBOz3gsZwMoP+yfBJTD NskfsZxsaKiSlDfuyt6xmuYgRdnGcOTnCO/68w3Plh8+9yBXCmUZVvEZWeMYxA== From: "Miguel Gazquez (Schneider Electric)" Date: Mon, 31 Aug 2026 18:06:23 +0200 Subject: [PATCH 6.6.y 4/4] ipv4: start using dst_dev_rcu() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260831-cve-2025-40074-6-6-v1-4-027e51b162a3@bootlin.com> References: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> In-Reply-To: <20260831-cve-2025-40074-6-6-v1-0-027e51b162a3@bootlin.com> To: stable@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Martin KaFai Lau , Wei Wang , David Ahern , Steffen Klassert , Herbert Xu , Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal Cc: Thomas Petazzoni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, "Miguel Gazquez (Schneider Electric)" X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788192387; l=3497; i=miguel.gazquez@bootlin.com; s=20250708; h=from:subject:message-id; bh=34JJFq8RSXI5UoGgxvCuwKAwd5I70OkLIjHzCunZECQ=; b=wnwpLQ13J//AszAdF09FF/t/gV8ORXxpyI8MvO6cNC9oEATsu9dznMsf1BGK8YBH24lx/7Fk4 8e6ZmCEIG6DAOUWlzWk7FXW3mmzz733P/F1Sev7DcAYtghwAy7MiulD X-Developer-Key: i=miguel.gazquez@bootlin.com; a=ed25519; pk=k/2KI9jkmayaF0ghZ8QYUH9Wm/kFHDhl8QoZ0RHbr4w= X-Last-TLS-Session-Version: TLSv1.3 From: Eric Dumazet [ Upstream commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 ] Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20250828195823.3958522-9-edumazet@google.com Signed-off-by: Jakub Kicinski [ minor modifications to fix conflict ] Signed-off-by: Miguel Gazquez (Schneider Electric) --- net/ipv4/icmp.c | 6 +++--- net/ipv4/ip_fragment.c | 6 ++++-- net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 4 ++-- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index f0c8c3366740..5c38af80bc14 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -320,17 +320,17 @@ static bool icmpv4_xrlim_allow(struct net *net, struc= t rtable *rt, return true; =20 /* No rate limit on loopback */ - dev =3D dst_dev(dst); + rcu_read_lock(); + dev =3D dst_dev_rcu(dst); if (dev && (dev->flags & IFF_LOOPBACK)) goto out; =20 - rcu_read_lock(); peer =3D inet_getpeer_v4(net->ipv4.peers, fl4->daddr, l3mdev_master_ifindex_rcu(dev)); rc =3D inet_peer_xrlim_allow(peer, READ_ONCE(net->ipv4.sysctl_icmp_ratelimit)); - rcu_read_unlock(); out: + rcu_read_unlock(); if (!rc) __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST); else diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 46b84d029205..e79ebe911548 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -470,14 +470,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_bu= ff *skb, /* Process an incoming IP datagram fragment. */ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) { - struct net_device *dev =3D skb->dev ? : skb_dst_dev(skb); - int vif =3D l3mdev_master_ifindex_rcu(dev); + struct net_device *dev; struct ipq *qp; + int vif; =20 __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS); =20 /* Lookup (or create) queue header */ rcu_read_lock(); + dev =3D skb->dev ? : skb_dst_dev_rcu(skb); + vif =3D l3mdev_master_ifindex_rcu(dev); qp =3D ip_find(net, ip_hdr(skb), user, vif); if (qp) { int ret, refs =3D 0; diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index af9412a507cf..f39cd565569a 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1893,7 +1893,7 @@ static void ipmr_queue_xmit(struct net *net, struct m= r_table *mrt, goto out_free; } =20 - dev =3D rt->dst.dev; + dev =3D dst_dev_rcu(&rt->dst); =20 if (skb->len+encap > dst_mtu(&rt->dst) && (ntohs(iph->frag_off) & IP_DF))= { /* Do not fragment multicasts. Alas, IPv4 does not diff --git a/net/ipv4/route.c b/net/ipv4/route.c index ce3397583b8f..b175a8292eb3 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -416,11 +416,11 @@ static struct neighbour *ipv4_neigh_lookup(const stru= ct dst_entry *dst, const void *daddr) { const struct rtable *rt =3D container_of(dst, struct rtable, dst); - struct net_device *dev =3D dst_dev(dst); + struct net_device *dev; struct neighbour *n; =20 rcu_read_lock(); - + dev =3D dst_dev_rcu(dst); if (likely(rt->rt_gw_family =3D=3D AF_INET)) { n =3D ip_neigh_gw4(dev, rt->rt_gw4); } else if (rt->rt_gw_family =3D=3D AF_INET6) { --=20 2.55.0