[PATCH nf] netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked

[PATCH nf] netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked

[Jiayuan Chen]

This was reported by Sashiko [1].

The RCU walk over rt->fib6_siblings can spin forever if rt is unlinked
mid-iteration: rt->fib6_siblings.next still points into the old ring,
so the loop never meets &rt->fib6_siblings as its terminator.

fib6_purge_rt() always does WRITE_ONCE(rt->fib6_nsiblings, 0) before
list_del_rcu(), so readers can use rt->fib6_nsiblings == 0 as the
detach signal. The same pattern is used in fib6_info_uses_dev() and
rt6_nlmsg_size().

[1]: https://sashiko.dev/#/patchset/20260520023411.391233-1-jiayuan.chen%40linux.dev
Suggested-by: Florian Westphal <fw@strlen.de>
Fixes: 1c32b24c234b ("netfilter: nft_fib_ipv6: switch to fib6_lookup")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/ipv6/netfilter/nft_fib_ipv6.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index c0a0075e2590..2dbe44715df3 100644
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -191,6 +191,9 @@ static bool nft_fib6_info_nh_uses_dev(struct fib6_info *rt,
 
 		if (nft_fib6_info_nh_dev_match(nh_dev, dev))
 			return true;
+
+		if (!READ_ONCE(rt->fib6_nsiblings))
+			return false;
 	}
 
 	return false;
-- 
2.43.0

Re: [PATCH nf] netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked

[Florian Westphal]

Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> This was reported by Sashiko [1].
> 
> The RCU walk over rt->fib6_siblings can spin forever if rt is unlinked
> mid-iteration: rt->fib6_siblings.next still points into the old ring,
> so the loop never meets &rt->fib6_siblings as its terminator.
> 
> fib6_purge_rt() always does WRITE_ONCE(rt->fib6_nsiblings, 0) before
> list_del_rcu(), so readers can use rt->fib6_nsiblings == 0 as the
> detach signal. The same pattern is used in fib6_info_uses_dev() and
> rt6_nlmsg_size().
> 
> [1]: https://sashiko.dev/#/patchset/20260520023411.391233-1-jiayuan.chen%40linux.dev
> Suggested-by: Florian Westphal <fw@strlen.de>
> Fixes: 1c32b24c234b ("netfilter: nft_fib_ipv6: switch to fib6_lookup")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  net/ipv6/netfilter/nft_fib_ipv6.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
> index c0a0075e2590..2dbe44715df3 100644
> --- a/net/ipv6/netfilter/nft_fib_ipv6.c
> +++ b/net/ipv6/netfilter/nft_fib_ipv6.c
> @@ -191,6 +191,9 @@ static bool nft_fib6_info_nh_uses_dev(struct fib6_info *rt,
>  
>  		if (nft_fib6_info_nh_dev_match(nh_dev, dev))
>  			return true;
> +
> +		if (!READ_ONCE(rt->fib6_nsiblings))
> +			return false;
>  	}

This time sashiko points to same bug pattern in rt6_fill_node:

This is a pre-existing issue, but does rt6_fill_node() also need this
detach check to prevent the same infinite loop?

https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

(No need to resend this patch, but maybe you have cycles to fix the
 other spot too)

Re: [PATCH nf] netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked

[Jiayuan Chen]

On 5/26/26 10:17 PM, Florian Westphal wrote:
>> diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
>> index c0a0075e2590..2dbe44715df3 100644
>> --- a/net/ipv6/netfilter/nft_fib_ipv6.c
>> +++ b/net/ipv6/netfilter/nft_fib_ipv6.c
>> @@ -191,6 +191,9 @@ static bool nft_fib6_info_nh_uses_dev(struct fib6_info *rt,
>>   
>>   		if (nft_fib6_info_nh_dev_match(nh_dev, dev))
>>   			return true;
>> +
>> +		if (!READ_ONCE(rt->fib6_nsiblings))
>> +			return false;
>>   	}
> This time sashiko points to same bug pattern in rt6_fill_node:
>
> This is a pre-existing issue, but does rt6_fill_node() also need this
> detach check to prevent the same infinite loop?
>
> https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev
>
> (No need to resend this patch, but maybe you have cycles to fix the
>   other spot too)



Hi Florian,

Thanks for the heads-up. After auditing the rest of net/ipv6/route.c
I noticed fib6_select_path() seems to have the same pattern as well
(walks &first->fib6_siblings under RCU with no inside-loop bail-out).

I'll send fixes for both spots directly against net.

Thanks,
Jiayuan