[PATCH net-next] ipv6: guard ip6_mr_output() with rcu

[PATCH net-next] ipv6: guard ip6_mr_output() with rcu

[Eric Dumazet]

syzbot found at least one path leads to an ip_mr_output()
without RCU being held.

Add guard(rcu)() to fix this in a concise way.

WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121
Call Trace:
 <TASK>
  ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline]
  udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112
  send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152
  wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178
  wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
  wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276
  process_one_work kernel/workqueue.c:3239 [inline]
  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
  kthread+0x70e/0x8a0 kernel/kthread.c:464
  ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Fixes: 96e8f5a9fe2d ("net: ipv6: Add ip6_mr_output()")
Reported-by: syzbot+0141c834e47059395621@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/685e86b3.a00a0220.129264.0003.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Petr Machata <petrm@nvidia.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Benjamin Poirier <bpoirier@nvidia.com>
Cc: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv6/ip6mr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index a35f4f1c658960e4b087848461f3ea7af653d070..eb6a00262510f1cd6a9d48fab80bdd0d496bb7ee 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2373,7 +2373,7 @@ int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 	int err;
 	int vif;
 
-	WARN_ON_ONCE(!rcu_read_lock_held());
+	guard(rcu)();
 
 	if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
 		goto ip6_output;
-- 
2.50.0.727.gbf7dc18ff4-goog

Re: [PATCH net-next] ipv6: guard ip6_mr_output() with rcu

[Nikolay Aleksandrov]

On 6/27/25 14:58, Eric Dumazet wrote:
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
> 
> Add guard(rcu)() to fix this in a concise way.
> 
> WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121
> Call Trace:
>  <TASK>
>   ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline]
>   udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112
>   send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152
>   wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178
>   wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
>   wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276
>   process_one_work kernel/workqueue.c:3239 [inline]
>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
>   kthread+0x70e/0x8a0 kernel/kthread.c:464
>   ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> 
> Fixes: 96e8f5a9fe2d ("net: ipv6: Add ip6_mr_output()")
> Reported-by: syzbot+0141c834e47059395621@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/685e86b3.a00a0220.129264.0003.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Benjamin Poirier <bpoirier@nvidia.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv6/ip6mr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
> index a35f4f1c658960e4b087848461f3ea7af653d070..eb6a00262510f1cd6a9d48fab80bdd0d496bb7ee 100644
> --- a/net/ipv6/ip6mr.c
> +++ b/net/ipv6/ip6mr.c
> @@ -2373,7 +2373,7 @@ int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
>  	int err;
>  	int vif;
>  
> -	WARN_ON_ONCE(!rcu_read_lock_held());
> +	guard(rcu)();
>  
>  	if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
>  		goto ip6_output;

Thanks,
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>

Re: [PATCH net-next] ipv6: guard ip6_mr_output() with rcu

[Petr Machata]

Eric Dumazet <edumazet@google.com> writes:

> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
>
> Add guard(rcu)() to fix this in a concise way.
>
> WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121
> Call Trace:
>  <TASK>
>   ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline]
>   udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112
>   send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152
>   wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178
>   wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
>   wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276
>   process_one_work kernel/workqueue.c:3239 [inline]
>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
>   kthread+0x70e/0x8a0 kernel/kthread.c:464
>   ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
>
> Fixes: 96e8f5a9fe2d ("net: ipv6: Add ip6_mr_output()")
> Reported-by: syzbot+0141c834e47059395621@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/685e86b3.a00a0220.129264.0003.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Benjamin Poirier <bpoirier@nvidia.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv6/ip6mr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
> index a35f4f1c658960e4b087848461f3ea7af653d070..eb6a00262510f1cd6a9d48fab80bdd0d496bb7ee 100644
> --- a/net/ipv6/ip6mr.c
> +++ b/net/ipv6/ip6mr.c
> @@ -2373,7 +2373,7 @@ int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
>  	int err;
>  	int vif;
>  
> -	WARN_ON_ONCE(!rcu_read_lock_held());
> +	guard(rcu)();
>  
>  	if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
>  		goto ip6_output;

Thanks for the fix!

Reviewed-by: Petr Machata <petrm@nvidia.com>

Re: [PATCH net-next] ipv6: guard ip6_mr_output() with rcu

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 27 Jun 2025 11:58:21 +0000 you wrote:
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
> 
> Add guard(rcu)() to fix this in a concise way.
> 
> WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121
> Call Trace:
>  <TASK>
>   ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline]
>   udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112
>   send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152
>   wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178
>   wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
>   wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276
>   process_one_work kernel/workqueue.c:3239 [inline]
>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
>   kthread+0x70e/0x8a0 kernel/kthread.c:464
>   ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> 
> [...]

Here is the summary with links:
  - [net-next] ipv6: guard ip6_mr_output() with rcu
    https://git.kernel.org/netdev/net-next/c/af232e7615e4

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html