Re: [PATCH net] ipv6: account route exceptions to the netns of their dst

[kuniyu@google.com]

On Fri, 16 Oct 2026 11:15:56 +0200, Eric Dumazet wrote:
> rt6_insert_exception() and rt6_remove_exception() update
> rt6_stats->fib_rt_cache of dev_net(rt6i->dst.dev), but the device of an
> exception dst can move to another netns while the exception is still in
> its bucket.
> 
> This happens when the bucket is flushed from an RCU callback, for
> instance from nexthop_free_rcu() for the nh_info of a replaced nexthop,
> whose exceptions still point to live routes. If the device moves to
> another netns before that callback runs, the decrement hits the other
> netns, whose u32 counter underflows in /proc/net/rt6_stats, while the
> counter of the original netns never goes back down.
> 
> Account exceptions to the netns their dst was allocated in, derived from
> dst->ops as ip6_dst_gc() already does, which does not depend on the
> device. The dst already relies on that netns' ip6_dst_ops being alive
> when it is destroyed, which happens after the exception is removed.
> 
> Fixes: 81eb8447daae ("ipv6: take care of rt6_stats")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>