* [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown [not found] <cover.1774855883.git.zcliangcn@gmail.com> @ 2026-03-30 8:46 ` Ren Wei 2026-03-31 8:56 ` Eric Dumazet 2026-04-01 2:10 ` patchwork-bot+netdevbpf 0 siblings, 2 replies; 3+ messages in thread From: Ren Wei @ 2026-03-30 8:46 UTC (permalink / raw) To: security Cc: davem, dsahern, edumazet, kuba, pabeni, horms, afaerber, mani, yoshfuji, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, zcliangcn, n05ec, netdev, linux-arm-kernel, linux-actions, linux-kernel From: Zhengchuan Liang <zcliangcn@gmail.com> `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock and prints `fl->opt->opt_nflen` when an option block is present. Exclusive flowlabels currently free `fl->opt` as soon as `fl->users` drops to zero in `fl_release()`. However, the surrounding `struct ip6_flowlabel` remains visible in the global hash table until later garbage collection removes it and `fl_free_rcu()` finally tears it down. A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that early `kfree()` and dereference freed option state, triggering a crash in `ip6fl_seq_show()`. Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU. Fixes: d3aedd5ebd4b ("ipv6 flowlabel: Convert hash list to RCU.") Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Co-developed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Yuan Tan <yuantan098@gmail.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Tested-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> --- net/ipv6/ip6_flowlabel.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c index 7c12bf75beedf..c92f98c6f6ecc 100644 --- a/net/ipv6/ip6_flowlabel.c +++ b/net/ipv6/ip6_flowlabel.c @@ -133,11 +133,6 @@ static void fl_release(struct ip6_flowlabel *fl) if (time_after(ttd, fl->expires)) fl->expires = ttd; ttd = fl->expires; - if (fl->opt && fl->share == IPV6_FL_S_EXCL) { - struct ipv6_txoptions *opt = fl->opt; - fl->opt = NULL; - kfree(opt); - } if (!timer_pending(&ip6_fl_gc_timer) || time_after(ip6_fl_gc_timer.expires, ttd)) mod_timer(&ip6_fl_gc_timer, ttd); -- 2.43.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown 2026-03-30 8:46 ` [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Ren Wei @ 2026-03-31 8:56 ` Eric Dumazet 2026-04-01 2:10 ` patchwork-bot+netdevbpf 1 sibling, 0 replies; 3+ messages in thread From: Eric Dumazet @ 2026-03-31 8:56 UTC (permalink / raw) To: Ren Wei Cc: security, davem, dsahern, kuba, pabeni, horms, afaerber, mani, yoshfuji, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, zcliangcn, netdev, linux-arm-kernel, linux-actions, linux-kernel On Mon, Mar 30, 2026 at 1:52 AM Ren Wei <n05ec@lzu.edu.cn> wrote: > > From: Zhengchuan Liang <zcliangcn@gmail.com> > > `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file > RCU read-side lock and prints `fl->opt->opt_nflen` when an option block > is present. > > Exclusive flowlabels currently free `fl->opt` as soon as `fl->users` > drops to zero in `fl_release()`. However, the surrounding > `struct ip6_flowlabel` remains visible in the global hash table until > later garbage collection removes it and `fl_free_rcu()` finally tears it > down. > > A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that > early `kfree()` and dereference freed option state, triggering a crash > in `ip6fl_seq_show()`. > > Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches > the lifetime already required for the enclosing flowlabel while readers > can still reach it under RCU. > > Fixes: d3aedd5ebd4b ("ipv6 flowlabel: Convert hash list to RCU.") > Reported-by: Yifan Wu <yifanwucs@gmail.com> > Reported-by: Juefei Pu <tomapufckgml@gmail.com> > Co-developed-by: Yuan Tan <yuantan098@gmail.com> > Signed-off-by: Yuan Tan <yuantan098@gmail.com> > Suggested-by: Xin Liu <bird@lzu.edu.cn> > Tested-by: Ren Wei <enjou1224z@gmail.com> > Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com> > Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Quite a long and confusing list of tags, and a long CC list ... Please trim this next time you submit a networking patch. Reviewed-by: Eric Dumazet <edumazet@google.com> ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown 2026-03-30 8:46 ` [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Ren Wei 2026-03-31 8:56 ` Eric Dumazet @ 2026-04-01 2:10 ` patchwork-bot+netdevbpf 1 sibling, 0 replies; 3+ messages in thread From: patchwork-bot+netdevbpf @ 2026-04-01 2:10 UTC (permalink / raw) To: Yang Yang Cc: security, davem, dsahern, edumazet, kuba, pabeni, horms, afaerber, mani, yoshfuji, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, zcliangcn, netdev, linux-arm-kernel, linux-actions, linux-kernel Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 30 Mar 2026 16:46:24 +0800 you wrote: > From: Zhengchuan Liang <zcliangcn@gmail.com> > > `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file > RCU read-side lock and prints `fl->opt->opt_nflen` when an option block > is present. > > Exclusive flowlabels currently free `fl->opt` as soon as `fl->users` > drops to zero in `fl_release()`. However, the surrounding > `struct ip6_flowlabel` remains visible in the global hash table until > later garbage collection removes it and `fl_free_rcu()` finally tears it > down. > > [...] Here is the summary with links: - [1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown https://git.kernel.org/netdev/net/c/9ca562bb8e66 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-01 2:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <cover.1774855883.git.zcliangcn@gmail.com>
2026-03-30 8:46 ` [PATCH 1/1] net: ipv6: flowlabel: defer exclusive option free until RCU teardown Ren Wei
2026-03-31 8:56 ` Eric Dumazet
2026-04-01 2:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox