[PATCH net] ipv6: use RCU iterator to dump route exceptions

[PATCH net] ipv6: use RCU iterator to dump route exceptions

[Yuyang Huang]

rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().

KCSAN reports this race (irrelevant details omitted):

  ==================================================================
  BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions

  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
    rt6_insert_exception+0x3bb/0x760
    __ip6_rt_update_pmtu+0x4fe/0x750
    ip6_sk_update_pmtu+0x19a/0x3b0
    udpv6_err+0x3ff/0x800
    icmpv6_notify+0x1e1/0x440
    icmpv6_rcv+0x8c0/0xab0
    ip6_protocol_deliver_rcu+0x616/0x840
    ip6_input_finish+0xb9/0x160
    ...
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
    rt6_nh_dump_exceptions+0xb3/0x260
    rt6_dump_route+0x53e/0x5f0
    fib6_dump_node+0x6d/0xf0
    fib6_walk_continue+0x290/0x2d0
    fib6_dump_table+0x28d/0x360
    inet6_dump_fib+0x37d/0x620
    rtnl_dumpit+0x7b/0xd0
    netlink_dump+0x3ae/0x7e0
    ...
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

  4 locks held by dumper/549:
    ...
    #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
    #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
    #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0

  value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100

  Reported by Kernel Concurrency Sanitizer on:
  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
  7.2.0-rc7-virtme #38 PREEMPT(lazy)
  ...

Use hlist_for_each_entry_rcu() to safely iterate over the exception list.

Fixes: 1e47b4837f3b ("ipv6: Dump route exceptions if requested")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
---
 net/ipv6/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 16dfac54a259..526535387512 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -6046,7 +6046,7 @@ static int rt6_nh_dump_exceptions(struct fib6_nh *nh, void *arg)
 		return 0;
 
 	for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
-		hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+		hlist_for_each_entry_rcu(rt6_ex, &bucket->chain, hlist) {
 			if (w->skip) {
 				w->skip--;
 				continue;
-- 
2.43.0

Re: [PATCH net] ipv6: use RCU iterator to dump route exceptions

[Stefano Brivio]

On Sat, 15 Aug 2026 17:46:51 +0900
Yuyang Huang <sigefriedhyy@gmail.com> wrote:

> rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
> RCU-protected exception lists. The caller holds rcu_read_lock(), but does
> not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
> add an entry with hlist_add_head_rcu().

Ah, right, I didn't consider that, thanks for fixing this.

> 
> KCSAN reports this race (irrelevant details omitted):
> 
>   ==================================================================
>   BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions
> 
>   write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
>     rt6_insert_exception+0x3bb/0x760
>     __ip6_rt_update_pmtu+0x4fe/0x750
>     ip6_sk_update_pmtu+0x19a/0x3b0
>     udpv6_err+0x3ff/0x800
>     icmpv6_notify+0x1e1/0x440
>     icmpv6_rcv+0x8c0/0xab0
>     ip6_protocol_deliver_rcu+0x616/0x840
>     ip6_input_finish+0xb9/0x160
>     ...
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
>   read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
>     rt6_nh_dump_exceptions+0xb3/0x260
>     rt6_dump_route+0x53e/0x5f0
>     fib6_dump_node+0x6d/0xf0
>     fib6_walk_continue+0x290/0x2d0
>     fib6_dump_table+0x28d/0x360
>     inet6_dump_fib+0x37d/0x620
>     rtnl_dumpit+0x7b/0xd0
>     netlink_dump+0x3ae/0x7e0
>     ...
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
>   4 locks held by dumper/549:
>     ...
>     #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
>     #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
>     #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0
> 
>   value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100
> 
>   Reported by Kernel Concurrency Sanitizer on:
>   CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
>   7.2.0-rc7-virtme #38 PREEMPT(lazy)
>   ...
> 
> Use hlist_for_each_entry_rcu() to safely iterate over the exception list.
> 
> Fixes: 1e47b4837f3b ("ipv6: Dump route exceptions if requested")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
> ---
>  net/ipv6/route.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 16dfac54a259..526535387512 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -6046,7 +6046,7 @@ static int rt6_nh_dump_exceptions(struct fib6_nh *nh, void *arg)
>  		return 0;
>  
>  	for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
> -		hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
> +		hlist_for_each_entry_rcu(rt6_ex, &bucket->chain, hlist) {
>  			if (w->skip) {
>  				w->skip--;
>  				continue;

Reviewed-by: Stefano Brivio <sbrivio@redhat.com>

-- 
Stefano