Re: [PATCH net 1/2] ipv6: Hold RCU when emitting route hardware flags notification

[David Ahern <dsahern@kernel.org>]

On 10/19/26 8:03 AM, Ido Schimmel wrote:
> fib6_info_hw_flags_set() is called by drivers from process context
> without RTNL or RCU. When the route uses a nexthop object,
> rt6_nlmsg_size() and rt6_fill_node() access the nexthop's RCU protected
> nexthop info and group pointers via rcu_dereference_rtnl(), resulting in
> suspicious RCU usage splats [1].
> 
> Fix by holding RCU while sizing and filling the notification, like
> fib_alias_hw_flags_set() already does. Switch to GFP_ATOMIC for the skb
> allocation accordingly.
> 
> Reproducer:
> 
>  # echo "10 0" > /sys/bus/netdevsim/new_device
>  # sysctl -wq net.ipv6.fib_notify_on_flag_change=1
>  # sysctl -wq net.ipv4.nexthop_compat_mode=1
>  # ip -6 nexthop add id 1 blackhole
>  # ip -6 route add 2001:db8:1::1/128 nhid 1
> 
> [1]
> WARNING: suspicious RCU usage
> 7.3.0-rc7-virtme-g191aa41548b2 #38 Not tainted
> net/ipv4/nexthop.c:1539 suspicious rcu_dereference_check() usage!
> [...]
> Workqueue: events nsim_fib_event_work
> Call Trace:
>  <TASK>
>  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
>  lockdep_rcu_suspicious.cold (kernel/locking/lockdep.c:6972)
>  nexthop_for_each_fib6_nh (net/ipv4/nexthop.c:1539 (discriminator 16))
>  rt6_nlmsg_size (net/ipv6/route.c:5728)
>  fib6_info_hw_flags_set (net/ipv6/route.c:6503)
>  nsim_fib6_rt_add (drivers/net/netdevsim/fib.c:671 drivers/net/netdevsim/fib.c:694)
>  nsim_fib6_rt_insert (drivers/net/netdevsim/fib.c:759)
>  nsim_fib_event_work (drivers/net/netdevsim/fib.c:856 drivers/net/netdevsim/fib.c:889 drivers/net/netdevsim/fib.c:1493)
>  process_one_work (kernel/workqueue.c:3396)
>  worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
>  kthread (kernel/kthread.c:436)
>  ret_from_fork (arch/x86/kernel/process.c:158)
>  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>  </TASK>
> 
> Fixes: 907eea486888 ("net: ipv6: Emit notification when fib hardware flags are changed")
> Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
> Closes: https://lore.kernel.org/netdev/179152182668.434549.18232968419539498055@kernel.org/
> Assisted-by: LLM
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv6/route.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>