[PATCH net-next v2 0/2] ipv6: fix rt6_fill_node() multicast route query handling

[PATCH net-next v2 0/2] ipv6: fix rt6_fill_node() multicast route query handling

[Wenbo Sun]

When querying an IPv6 multicast route with an input interface via
"ip -6 route get <mcast_addr> from <src_addr> iif <dev>", rt6_fill_node()
currently calls ip6mr_get_route() unconditionally and masks any negative
error returned by ip6mr_get_route() with -EMSGSIZE at nla_put_failure.

Patch 1 checks mc_forwarding before calling ip6mr_get_route(), matching
IPv4 rt_fill_info() so queries succeed with RTA_IIF when multicast
routing is disabled. Patch 2 preserves the negative error returned by
ip6mr_get_route() instead of overwriting it with -EMSGSIZE when
multicast forwarding is enabled.

Thanks to Hangbin Liu for reviewing v1 and pointing out the error
masking issue in rt6_fill_node().

Changes in v2:
- Reword patch 1 commit message for clearer tone and carry
  Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>.
- Add patch 2 to preserve negative errors returned by ip6mr_get_route()
  instead of returning -EMSGSIZE from nla_put_failure, with
  Suggested-by: Hangbin Liu <liuhangbin@kylinos.cn>.
- Verify both mc_forwarding=0 and mc_forwarding=1 (MRT6_INIT) cases in
  a UML kernel alongside W=1 builds on UML, x86_64 allmodconfig, and
  x86_64 allyesconfig.

Link: https://lore.kernel.org/netdev/20261111094528.425826-1-sunwenbo@cmss.chinamobile.com/ [v1]

Wenbo Sun (2):
  ipv6: check mc_forwarding before calling ip6mr_get_route()
  ipv6: preserve ip6mr_get_route() error in rt6_fill_node()

 net/ipv6/route.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

-- 
2.33.0

[PATCH net-next v2 1/2] ipv6: check mc_forwarding before calling ip6mr_get_route()

[Wenbo Sun]

When CONFIG_IPV6_MROUTE is enabled, rt6_fill_node() calls
ip6mr_get_route() whenever an input interface is specified and the
destination address is multicast.

However, when multicast routing is not enabled in the network namespace
(i.e. mc_forwarding is 0), there is typically no matching (S,G)
multicast routing cache entry, and skb->dev is NULL in the query skb
allocated by inet6_rtm_getroute(). As a result, ip6mr_get_route()
returns -ENODEV, which causes rt6_fill_node() to jump to
nla_put_failure and report -EMSGSIZE ("RTNETLINK answers: Message too
long") to userspace.

In contrast, the IPv4 counterpart rt_fill_info() checks
IPV4_DEVCONF_ALL_RO(net, MC_FORWARDING) before calling ipmr_get_route(),
so queries with mc_forwarding disabled fall back to emitting RTA_IIF and
normal route attributes.

This discrepancy was identified with the assistance of an LLM-based code
review comparing IPv4 and IPv6 multicast route get handling, confirmed on
a UML kernel where "ip -6 route get <mcast_addr> from <src_addr> iif
<dev>" returned -EMSGSIZE on an unpatched kernel, and verified after the
change that multicast route get with iif succeeds while unicast and
non-iif multicast queries continue to work as expected.

Check atomic_read(&net->ipv6.devconf_all->mc_forwarding) before calling
ip6mr_get_route() in rt6_fill_node() so that queries with multicast
forwarding disabled report RTA_IIF and normal route attributes, matching
IPv4 behavior.

Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
zero new warnings or errors.

Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 net/ipv6/route.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 2eb884558c24..6dd4a70f6490 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5862,7 +5862,8 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 #endif
 	if (iif) {
 #ifdef CONFIG_IPV6_MROUTE
-		if (ipv6_addr_is_multicast(&rt6_dst->addr)) {
+		if (ipv6_addr_is_multicast(&rt6_dst->addr) &&
+		    atomic_read(&net->ipv6.devconf_all->mc_forwarding)) {
 			int err = ip6mr_get_route(net, skb, rtm, portid);
 
 			if (err == 0)
-- 
2.33.0

[PATCH net-next v2 2/2] ipv6: preserve ip6mr_get_route() error in rt6_fill_node()

[Wenbo Sun]

In rt6_fill_node(), when ip6mr_get_route() fails with a negative error
(for example -ENODEV, -ENOENT, -ENOMEM, or -ENOBUFS), the error path
currently jumps to nla_put_failure and unconditionally returns -EMSGSIZE
("RTNETLINK answers: Message too long").

Among all callers of rt6_fill_node(), only inet6_rtm_getroute() passes
a non-zero iif and propagates negative errors back to userspace. Keeping
-EMSGSIZE as the default return value for attribute put failures while
preserving the negative error returned by ip6mr_get_route() lets
userspace see the actual failure reason when multicast forwarding is
enabled.

This issue was pointed out during code review of rt6_fill_node() by
Hangbin Liu, confirmed on a UML kernel with MRT6_INIT enabled (where
"ip -6 route get ff0e::1 from 2001:db8::3 iif d0" reported "Message too
long" despite the failure in ip6mr_get_route() being -ENODEV), and
verified after the patch that it returns -ENODEV ("No such device")
instead while other rt6_fill_node() paths behave unchanged.

Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
zero new warnings or errors.

Suggested-by: Hangbin Liu <liuhangbin@kylinos.cn>
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 net/ipv6/route.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6dd4a70f6490..11ce0db66484 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5808,6 +5808,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 	struct nlmsghdr *nlh;
 	struct rtmsg *rtm;
 	long expires = 0;
+	int err = -EMSGSIZE;
 
 	nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
 	if (!nlh)
@@ -5864,12 +5865,14 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 #ifdef CONFIG_IPV6_MROUTE
 		if (ipv6_addr_is_multicast(&rt6_dst->addr) &&
 		    atomic_read(&net->ipv6.devconf_all->mc_forwarding)) {
-			int err = ip6mr_get_route(net, skb, rtm, portid);
+			int ret = ip6mr_get_route(net, skb, rtm, portid);
 
-			if (err == 0)
+			if (ret == 0)
 				return 0;
-			if (err < 0)
+			if (ret < 0) {
+				err = ret;
 				goto nla_put_failure;
+			}
 		} else
 #endif
 			if (nla_put_u32(skb, RTA_IIF, iif))
@@ -5992,7 +5995,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 
 nla_put_failure:
 	nlmsg_cancel(skb, nlh);
-	return -EMSGSIZE;
+	return err;
 }
 
 static int fib6_info_nh_uses_dev(struct fib6_nh *nh, void *arg)
-- 
2.33.0

Re: [PATCH net-next v2 0/2] ipv6: fix rt6_fill_node() multicast route query handling

[Hangbin Liu]

On Thu, Nov 12, 2026 at 05:46:28PM +0800, Wenbo Sun wrote:
> When querying an IPv6 multicast route with an input interface via
> "ip -6 route get <mcast_addr> from <src_addr> iif <dev>", rt6_fill_node()
> currently calls ip6mr_get_route() unconditionally and masks any negative
> error returned by ip6mr_get_route() with -EMSGSIZE at nla_put_failure.
> 
> Patch 1 checks mc_forwarding before calling ip6mr_get_route(), matching
> IPv4 rt_fill_info() so queries succeed with RTA_IIF when multicast
> routing is disabled. Patch 2 preserves the negative error returned by
> ip6mr_get_route() instead of overwriting it with -EMSGSIZE when
> multicast forwarding is enabled.
> 
> Thanks to Hangbin Liu for reviewing v1 and pointing out the error
> masking issue in rt6_fill_node().
> 
> Changes in v2:
> - Reword patch 1 commit message for clearer tone and carry
>   Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>.
> - Add patch 2 to preserve negative errors returned by ip6mr_get_route()
>   instead of returning -EMSGSIZE from nla_put_failure, with
>   Suggested-by: Hangbin Liu <liuhangbin@kylinos.cn>.
> - Verify both mc_forwarding=0 and mc_forwarding=1 (MRT6_INIT) cases in
>   a UML kernel alongside W=1 builds on UML, x86_64 allmodconfig, and
>   x86_64 allyesconfig.
> 
> Link: https://lore.kernel.org/netdev/20261111094528.425826-1-sunwenbo@cmss.chinamobile.com/ [v1]
> 
> Wenbo Sun (2):
>   ipv6: check mc_forwarding before calling ip6mr_get_route()
>   ipv6: preserve ip6mr_get_route() error in rt6_fill_node()
> 
>  net/ipv6/route.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> -- 
> 2.33.0
> 
> 
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>