Re: [PATCH net v4] ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2025-12-23 13:14:12 [+0800], Jiayuan Chen wrote:
> On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the
> current task can be preempted. Another task running on the same CPU
> may then execute rt6_make_pcpu_route() and successfully install a
> pcpu_rt entry. When the first task resumes execution, its cmpxchg()
> in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer
> NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding
> mdelay() after rt6_get_pcpu_route().
> 
> Using preempt_disable/enable is not appropriate here because
> ip6_rt_pcpu_alloc() may sleep.
> 
> Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:
> free our allocation and return the existing pcpu_rt installed by
> another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT
> kernels where such races should not occur.
> 
> Link: https://syzkaller.appspot.com/bug?extid=9b35e9bc0951140d13e6
> Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
> Reported-by: syzbot+9b35e9bc0951140d13e6@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6918cd88.050a0220.1c914e.0045.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

This is upstream as commit
   1adaea51c61b5 ("ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT")

and should be backported down to v6.12 due to the fixes tag. RT wise it
should be broken since its introduction so if the stable team could take
it down to v5.10-rt, that would be nice.

Sebastian