All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15.y 1/2] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR
Date: Tue,  8 Sep 2026 20:25:06 -0400	[thread overview]
Message-ID: <20260909002507.725158-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090351-sagging-obliged-3e7b@gregkh>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 3bdfb04f13ebdd4ae50fc5dc595663874781e48c ]

IPv4 reassembly unit can decide to drop frags based on
/proc/sys/net/ipv4/ipfrag_max_dist sysctl.

Add a specific drop reason to track this specific
and weird case.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

[ Backport to 5.15: the original IPv4 drop-reason change cannot be
represented because this tree predates include/net/dropreason.h and the
reason-aware fragment purge API. Add only SKB_DROP_REASON_IPV6DISABLED to
the older enum and trace table, and align the IPv6 routing-header code so
the dependent fix applies cleanly. ]

[ sashal: Reduced backport -- upstream 3bdfb04f13ebd touches 2 file(s), this
  backport carries 3. Not backported here:
  include/net/dropreason.h
  net/ipv4/ip_fragment.c
  This note is generated from the file lists only; see the resolution record
  for the reasoning. ]

Stable-dep-of: f826df95332c ("ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/skbuff.h     |  1 +
 include/trace/events/skb.h |  1 +
 net/ipv6/exthdrs.c         | 12 +++---------
 3 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 24ceeab1b509f..af4924ceafe61 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -337,6 +337,7 @@ enum skb_drop_reason {
 						  * is multicast, but L3 is
 						  * unicast.
 						  */
+	SKB_DROP_REASON_IPV6DISABLED,	/* IPv6 is disabled on the device */
 	SKB_DROP_REASON_MAX,
 };
 
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 485a1d3034a4b..33bebe0c7677e 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -23,6 +23,7 @@
 	EM(SKB_DROP_REASON_IP_RPFILTER, IP_RPFILTER)		\
 	EM(SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST,		\
 	   UNICAST_IN_L2_MULTICAST)				\
+	EM(SKB_DROP_REASON_IPV6DISABLED, IPV6DISABLED)		\
 	EMe(SKB_DROP_REASON_MAX, MAX)
 
 #undef EM
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 3c6de4ccbf53b..3bfe826c3134f 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -495,7 +495,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 	struct net *net = dev_net(skb->dev);
 	struct inet6_dev *idev;
 	struct ipv6hdr *oldhdr;
-	struct in6_addr addr;
 	unsigned int chdr_len;
 	unsigned char *buf;
 	int accept_rpl_seg;
@@ -505,10 +504,8 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 
 	idev = __in6_dev_get(skb->dev);
 
-	accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
-	if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
-		accept_rpl_seg = idev->cnf.rpl_seg_enabled;
-
+	accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
+			     READ_ONCE(idev->cnf.rpl_seg_enabled));
 	if (!accept_rpl_seg) {
 		kfree_skb(skb);
 		return -1;
@@ -607,9 +604,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 		return -1;
 	}
 
-	addr = ipv6_hdr(skb)->daddr;
-	ipv6_hdr(skb)->daddr = ohdr->rpl_segaddr[i];
-	ohdr->rpl_segaddr[i] = addr;
+	swap(ipv6_hdr(skb)->daddr, ohdr->rpl_segaddr[i]);
 
 	ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
 
@@ -690,7 +685,6 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
 	struct net *net = dev_net(skb->dev);
 	int accept_source_route;
 
-	idev = __in6_dev_get(skb->dev);
 	accept_source_route = READ_ONCE(net->ipv6.devconf_all->accept_source_route);
 
 	if (idev)
-- 
2.53.0


  parent reply	other threads:[~2026-09-09  0:25 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03 14:00 FAILED: patch "[PATCH] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()" failed to apply to 5.15-stable tree gregkh
2026-09-08 22:37 ` [PATCH 5.15.y 1/3] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR Sasha Levin
2026-09-08 22:37   ` [PATCH 5.15.y 2/3] ipv6: icmp6: add drop reason support to ndisc_rcv() Sasha Levin
2026-09-08 22:37   ` [PATCH 5.15.y 3/3] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Sasha Levin
2026-09-09  0:25 ` Sasha Levin [this message]
2026-09-09  0:25   ` [PATCH 5.15.y 2/2] " Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260909002507.725158-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.