* [PATCH v5 net 1/3] ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
2026-03-19 4:13 [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Kuniyuki Iwashima
@ 2026-03-19 4:13 ` Kuniyuki Iwashima
2026-03-19 4:13 ` [PATCH v5 net 2/3] ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist Kuniyuki Iwashima
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Kuniyuki Iwashima @ 2026-03-19 4:13 UTC (permalink / raw)
To: David Ahern, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Kui-Feng Lee, Xin Long, Simon Horman, Kuniyuki Iwashima,
Kuniyuki Iwashima, netdev
Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a
separated list of routes.") introduced a per-table GC list and
changed GC to iterate over that list instead of traversing
the entire route table.
However, it forgot to add permanent routes to tb6_gc_hlist
when exception routes are added.
Commit cfe82469a00f ("ipv6: add exception routes to GC list
in rt6_insert_exception") fixed that issue but introduced
another one.
Even after all exception routes expire, the permanent routes
remain in tb6_gc_hlist, potentially negating the performance
benefits intended by the initial change.
Let's count gc_args->more before and after rt6_age_exceptions()
and remove the permanent route when the delta is 0.
Note that the next patch will reuse fib6_age_exceptions().
Fixes: cfe82469a00f ("ipv6: add exception routes to GC list in rt6_insert_exception")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
---
net/ipv6/ip6_fib.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 9058e71241dc..fadfca49d6b1 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -2348,6 +2348,17 @@ static void fib6_flush_trees(struct net *net)
/*
* Garbage collection
*/
+static void fib6_age_exceptions(struct fib6_info *rt, struct fib6_gc_args *gc_args,
+ unsigned long now)
+{
+ bool may_expire = rt->fib6_flags & RTF_EXPIRES && rt->expires;
+ int old_more = gc_args->more;
+
+ rt6_age_exceptions(rt, gc_args, now);
+
+ if (!may_expire && old_more == gc_args->more)
+ fib6_remove_gc_list(rt);
+}
static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
{
@@ -2370,7 +2381,7 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
* Note, that clones are aged out
* only if they are not in use now.
*/
- rt6_age_exceptions(rt, gc_args, now);
+ fib6_age_exceptions(rt, gc_args, now);
return 0;
}
--
2.53.0.851.ga537e3e6e9-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 net 2/3] ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
2026-03-19 4:13 [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Kuniyuki Iwashima
2026-03-19 4:13 ` [PATCH v5 net 1/3] ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire Kuniyuki Iwashima
@ 2026-03-19 4:13 ` Kuniyuki Iwashima
2026-03-19 4:13 ` [PATCH v5 net 3/3] selftest: net: Add GC test for temporary routes with exceptions Kuniyuki Iwashima
2026-03-19 14:28 ` [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Kuniyuki Iwashima @ 2026-03-19 4:13 UTC (permalink / raw)
To: David Ahern, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Kui-Feng Lee, Xin Long, Simon Horman, Kuniyuki Iwashima,
Kuniyuki Iwashima, netdev
The cited commit mechanically put fib6_remove_gc_list()
just after every fib6_clean_expires() call.
When a temporary route is promoted to a permanent route,
there may already be exception routes tied to it.
If fib6_remove_gc_list() removes the route from tb6_gc_hlist,
such exception routes will no longer be aged.
Let's replace fib6_remove_gc_list() with a new helper
fib6_may_remove_gc_list() and use fib6_age_exceptions() there.
Note that net->ipv6 is only compiled when CONFIG_IPV6 is
enabled, so fib6_{add,remove,may_remove}_gc_list() are guarded.
Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
v4: s/,/;/ for fib6_gc_args initialisation
v3: Use IS_ENABLED()
v2: Fix build failure when CONFIG_IPV6=n (no net->ipv6 definition)
---
include/net/ip6_fib.h | 19 ++++++++++++++++++-
net/ipv6/addrconf.c | 4 ++--
net/ipv6/ip6_fib.c | 6 +++---
net/ipv6/route.c | 2 +-
4 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 88b0dd4d8e09..438bcbc54a35 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -507,12 +507,14 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,
void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info,
unsigned int flags);
+void fib6_age_exceptions(struct fib6_info *rt, struct fib6_gc_args *gc_args,
+ unsigned long now);
void fib6_run_gc(unsigned long expires, struct net *net, bool force);
-
void fib6_gc_cleanup(void);
int fib6_init(void);
+#if IS_ENABLED(CONFIG_IPV6)
/* Add the route to the gc list if it is not already there
*
* The callers should hold f6i->fib6_table->tb6_lock.
@@ -545,6 +547,21 @@ static inline void fib6_remove_gc_list(struct fib6_info *f6i)
hlist_del_init(&f6i->gc_link);
}
+static inline void fib6_may_remove_gc_list(struct net *net,
+ struct fib6_info *f6i)
+{
+ struct fib6_gc_args gc_args;
+
+ if (hlist_unhashed(&f6i->gc_link))
+ return;
+
+ gc_args.timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_interval);
+ gc_args.more = 0;
+
+ fib6_age_exceptions(f6i, &gc_args, jiffies);
+}
+#endif
+
struct ipv6_route_iter {
struct seq_net_private p;
struct fib6_walker w;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0e55f139e05d..f4e23b543585 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2862,7 +2862,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
fib6_add_gc_list(rt);
} else {
fib6_clean_expires(rt);
- fib6_remove_gc_list(rt);
+ fib6_may_remove_gc_list(net, rt);
}
spin_unlock_bh(&table->tb6_lock);
@@ -4840,7 +4840,7 @@ static int modify_prefix_route(struct net *net, struct inet6_ifaddr *ifp,
if (!(flags & RTF_EXPIRES)) {
fib6_clean_expires(f6i);
- fib6_remove_gc_list(f6i);
+ fib6_may_remove_gc_list(net, f6i);
} else {
fib6_set_expires(f6i, expires);
fib6_add_gc_list(f6i);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index fadfca49d6b1..dd26657b6a4a 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1133,7 +1133,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
return -EEXIST;
if (!(rt->fib6_flags & RTF_EXPIRES)) {
fib6_clean_expires(iter);
- fib6_remove_gc_list(iter);
+ fib6_may_remove_gc_list(info->nl_net, iter);
} else {
fib6_set_expires(iter, rt->expires);
fib6_add_gc_list(iter);
@@ -2348,8 +2348,8 @@ static void fib6_flush_trees(struct net *net)
/*
* Garbage collection
*/
-static void fib6_age_exceptions(struct fib6_info *rt, struct fib6_gc_args *gc_args,
- unsigned long now)
+void fib6_age_exceptions(struct fib6_info *rt, struct fib6_gc_args *gc_args,
+ unsigned long now)
{
bool may_expire = rt->fib6_flags & RTF_EXPIRES && rt->expires;
int old_more = gc_args->more;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 08cd86f49bf9..cb521700cee7 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1033,7 +1033,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
if (!addrconf_finite_timeout(lifetime)) {
fib6_clean_expires(rt);
- fib6_remove_gc_list(rt);
+ fib6_may_remove_gc_list(net, rt);
} else {
fib6_set_expires(rt, jiffies + HZ * lifetime);
fib6_add_gc_list(rt);
--
2.53.0.851.ga537e3e6e9-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v5 net 3/3] selftest: net: Add GC test for temporary routes with exceptions.
2026-03-19 4:13 [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Kuniyuki Iwashima
2026-03-19 4:13 ` [PATCH v5 net 1/3] ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire Kuniyuki Iwashima
2026-03-19 4:13 ` [PATCH v5 net 2/3] ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist Kuniyuki Iwashima
@ 2026-03-19 4:13 ` Kuniyuki Iwashima
2026-03-19 14:28 ` [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Jakub Kicinski
3 siblings, 0 replies; 6+ messages in thread
From: Kuniyuki Iwashima @ 2026-03-19 4:13 UTC (permalink / raw)
To: David Ahern, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Kui-Feng Lee, Xin Long, Simon Horman, Kuniyuki Iwashima,
Kuniyuki Iwashima, netdev
Without the prior commit, IPv6 GC cannot track exceptions tied
to permanent routes if they were originally added as temporary
routes.
Let's add a test case for the issue.
1. Add temporary routes
2. Create exceptions for the temporary routes
3. Promote the routes to permanent routes
4. Check if GC can find and purge the exceptions
A few notes:
+ At step 4, unlike other test cases, we cannot wait for
$GC_WAIT_TIME. While the exceptions are always iterable via
netlink (since it traverses the entire fib tree instead of
tb6_gc_hlist), rt6_nh_dump_exceptions() skips expired entries.
If we waited for the expiration time, we would be unable to
distinguish whether the exceptions were truly purged by GC or
just hidden due to being expired.
+ For the same reason, at step 2, we use ICMPv6 redirect message
instead of Packet Too Big message. This is because MTU exceptions
always have RTF_EXPIRES, and rt6_age_examine_exception() does not
respect the period specified by net.ipv6.route.flush=1.
+ We add a neighbour entry for the redirect target with NTF_ROUTER.
Without this, the exceptions would be removed at step 3 when the
fib6_may_remove_gc_list() is called.
Without the fix, the exceptions remain even after GC is triggered
by sysctl -wq net.ipv6.route.flush=1.
FAIL: Expected 0 routes, got 5
TEST: ipv6 route garbage collection (promote to permanent routes) [FAIL]
With the fix, GC purges the exceptions properly.
TEST: ipv6 route garbage collection (promote to permanent routes) [ OK ]
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
tools/testing/selftests/net/fib_tests.sh | 61 ++++++++++++++++++++++--
1 file changed, 58 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index c5694cc4ddd2..829f72c8ee07 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -868,6 +868,64 @@ fib6_gc_test()
check_rt_num 5 $($IP -6 route list |grep -v expires|grep 2001:20::|wc -l)
log_test $ret 0 "ipv6 route garbage collection (replace with permanent)"
+ # Delete dummy_10 and remove all routes
+ $IP link del dev dummy_10
+
+ # rd6 is required for the next test. (ipv6toolkit)
+ if [ ! -x "$(command -v rd6)" ]; then
+ echo "SKIP: rd6 not found."
+ set +e
+ cleanup &> /dev/null
+ return
+ fi
+
+ setup_ns ns2
+ $IP link add veth1 type veth peer veth2 netns $ns2
+ $IP link set veth1 up
+ ip -netns $ns2 link set veth2 up
+ $IP addr add fe80:dead::1/64 dev veth1
+ ip -netns $ns2 addr add fe80:dead::2/64 dev veth2
+
+ # Add NTF_ROUTER neighbour to prevent rt6_age_examine_exception()
+ # from removing not-yet-expired exceptions.
+ ip -netns $ns2 link set veth2 address 00:11:22:33:44:55
+ $IP neigh add fe80:dead::3 lladdr 00:11:22:33:44:55 dev veth1 router
+
+ $NS_EXEC sysctl -wq net.ipv6.conf.veth1.accept_redirects=1
+ $NS_EXEC sysctl -wq net.ipv6.conf.veth1.forwarding=0
+
+ # Temporary routes
+ for i in $(seq 1 5); do
+ # Expire route after $EXPIRE seconds
+ $IP -6 route add 2001:10::$i \
+ via fe80:dead::2 dev veth1 expires $EXPIRE
+
+ ip netns exec $ns2 rd6 -i veth2 \
+ -s fe80:dead::2 -d fe80:dead::1 \
+ -r 2001:10::$i -t fe80:dead::3 -p ICMP6
+ done
+
+ check_rt_num 5 $($IP -6 route list | grep expires | grep 2001:10:: | wc -l)
+
+ # Promote to permanent routes by "prepend" (w/o NLM_F_EXCL and NLM_F_REPLACE)
+ for i in $(seq 1 5); do
+ # -EEXIST, but the temporary route becomes the permanent route.
+ $IP -6 route append 2001:10::$i \
+ via fe80:dead::2 dev veth1 2>/dev/null || true
+ done
+
+ check_rt_num 5 $($IP -6 route list | grep -v expires | grep 2001:10:: | wc -l)
+ check_rt_num 5 $($IP -6 route list cache | grep 2001:10:: | wc -l)
+
+ # Trigger GC instead of waiting $GC_WAIT_TIME.
+ # rt6_nh_dump_exceptions() just skips expired exceptions.
+ $NS_EXEC sysctl -wq net.ipv6.route.flush=1
+ check_rt_num 0 $($IP -6 route list cache | grep 2001:10:: | wc -l)
+ log_test $ret 0 "ipv6 route garbage collection (promote to permanent routes)"
+
+ $IP neigh del fe80:dead::3 lladdr 00:11:22:33:44:55 dev veth1 router
+ $IP link del veth1
+
# ra6 is required for the next test. (ipv6toolkit)
if [ ! -x "$(command -v ra6)" ]; then
echo "SKIP: ra6 not found."
@@ -876,9 +934,6 @@ fib6_gc_test()
return
fi
- # Delete dummy_10 and remove all routes
- $IP link del dev dummy_10
-
# Create a pair of veth devices to send a RA message from one
# device to another.
$IP link add veth1 type veth peer name veth2
--
2.53.0.851.ga537e3e6e9-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes.
2026-03-19 4:13 [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Kuniyuki Iwashima
` (2 preceding siblings ...)
2026-03-19 4:13 ` [PATCH v5 net 3/3] selftest: net: Add GC test for temporary routes with exceptions Kuniyuki Iwashima
@ 2026-03-19 14:28 ` Jakub Kicinski
2026-03-20 2:18 ` Kuniyuki Iwashima
3 siblings, 1 reply; 6+ messages in thread
From: Jakub Kicinski @ 2026-03-19 14:28 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: David Ahern, David S . Miller, Eric Dumazet, Paolo Abeni,
Kui-Feng Lee, Xin Long, Simon Horman, Kuniyuki Iwashima, netdev
On Thu, 19 Mar 2026 04:13:49 +0000 Kuniyuki Iwashima wrote:
> Patch 1 fixes the unbounded growth of tb6_gc_hlist due to
> permanent routes whose exception routes have all expired.
>
> Patch 2 fixes an issue where exception routes tied to
> permanent routes are not properly aged.
>
> Patch 3 is a selftest for the issue fixed by Patch 2.
Hitting a RCU warning with this:
[ 1246.404735][T26812] =============================
[ 1246.404892][T26812] WARNING: suspicious RCU usage
[ 1246.405029][T26812] 7.0.0-rc3-virtme #1 Not tainted
[ 1246.405170][T26812] -----------------------------
[ 1246.405302][T26812] ./include/net/neighbour.h:312 suspicious rcu_dereference_check() usage!
[ 1246.405498][T26812]
[ 1246.405498][T26812] other info that might help us debug this:
[ 1246.405498][T26812]
[ 1246.405786][T26812]
[ 1246.405786][T26812] rcu_scheduler_active = 2, debug_locks = 1
[ 1246.405988][T26812] 3 locks held by ip/26812:
[ 1246.406124][T26812] #0: ff11000015e71a30 (&tb->tb6_lock){+.-.}-{3:3}, at: ip6_route_add+0x95/0x160
[ 1246.406587][T26812] #1: ffffffffbc58c900 (rcu_read_lock_bh){....}-{1:3}, at: fib6_nh_age_exceptions.part.0+0x24/0x200
[ 1246.406873][T26812] #2: ffffffffbcdafbd8 (rt6_exception_lock){+.-.}-{3:3}, at: fib6_nh_age_exceptions.part.0+0x66/0x200
[ 1246.407143][T26812]
[ 1246.407143][T26812] stack backtrace:
[ 1246.407315][T26812] CPU: 3 UID: 0 PID: 26812 Comm: ip Not tainted 7.0.0-rc3-virtme #1 PREEMPT(full)
[ 1246.407318][T26812] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1246.407319][T26812] Call Trace:
[ 1246.407321][T26812] <TASK>
[ 1246.407322][T26812] dump_stack_lvl+0x6f/0xa0
[ 1246.407328][T26812] lockdep_rcu_suspicious.cold+0x4f/0xad
[ 1246.407334][T26812] ___neigh_lookup_noref.constprop.0+0x4d0/0x8e0
[ 1246.407339][T26812] rt6_age_examine_exception+0x209/0x510
[ 1246.407343][T26812] ? __ip6_del_rt+0x160/0x160
[ 1246.407346][T26812] ? fib6_nh_get_excptn_bucket+0x6e/0x150
[ 1246.407348][T26812] fib6_nh_age_exceptions.part.0+0xce/0x200
[ 1246.407352][T26812] rt6_age_exceptions+0xff/0x150
[ 1246.407355][T26812] ? rt6_flush_exceptions+0x1a0/0x1a0
[ 1246.407357][T26812] ? rcu_is_watching+0x15/0xd0
[ 1246.407361][T26812] ? rcu_is_watching+0x15/0xd0
[ 1246.407363][T26812] fib6_age_exceptions+0xc5/0x250
[ 1246.407366][T26812] fib6_add_rt2node+0x25c6/0x3f90
[ 1246.407368][T26812] ? pcpu_alloc_noprof+0x635/0xa60
[ 1246.407376][T26812] ? fib6_age_exceptions+0x250/0x250
[ 1246.407379][T26812] ? fib6_add_1.constprop.0+0x512/0x1620
[ 1246.407385][T26812] ? fib6_add+0x36a/0xe40
[ 1246.407386][T26812] fib6_add+0x36a/0xe40
[ 1246.407389][T26812] ? lock_acquire.part.0+0xbc/0x260
[ 1246.407392][T26812] ? fib6_add_rt2node+0x3f90/0x3f90
[ 1246.407398][T26812] ip6_route_add+0xa7/0x160
[ 1246.407400][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
[ 1246.407402][T26812] inet6_rtm_newroute+0x10a/0x120
[ 1246.407404][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
[ 1246.407406][T26812] ? lock_acquire.part.0+0xbc/0x260
[ 1246.407407][T26812] ? find_held_lock+0x2b/0x80
[ 1246.407415][T26812] ? __lock_release.isra.0+0x59/0x170
[ 1246.407418][T26812] ? rtnetlink_rcv_msg+0x6dc/0xb90
[ 1246.407422][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
[ 1246.407424][T26812] rtnetlink_rcv_msg+0x6fe/0xb90
[ 1246.407427][T26812] ? rtnl_fdb_dump+0x620/0x620
[ 1246.407429][T26812] ? __lock_acquire+0x577/0xc10
[ 1246.407433][T26812] ? lock_acquire.part.0+0xbc/0x260
[ 1246.407434][T26812] ? find_held_lock+0x2b/0x80
[ 1246.407438][T26812] netlink_rcv_skb+0x123/0x380
[ 1246.407441][T26812] ? rtnl_fdb_dump+0x620/0x620
[ 1246.407444][T26812] ? netlink_ack+0xce0/0xce0
[ 1246.407450][T26812] ? netlink_deliver_tap+0xc5/0x330
[ 1246.407451][T26812] ? netlink_deliver_tap+0x13f/0x330
[ 1246.407455][T26812] netlink_unicast+0x4a3/0x770
[ 1246.407458][T26812] ? netlink_attachskb+0x810/0x810
[ 1246.407460][T26812] ? __alloc_skb+0x4c4/0x5f0
[ 1246.407463][T26812] ? napi_skb_cache_get+0x7a0/0x7a0
[ 1246.407465][T26812] ? lock_acquire.part.0+0xbc/0x260
[ 1246.407467][T26812] ? __lock_acquire+0x577/0xc10
[ 1246.407470][T26812] netlink_sendmsg+0x735/0xc60
[ 1246.407473][T26812] ? netlink_unicast+0x770/0x770
[ 1246.407477][T26812] ? __might_fault+0x97/0x140
[ 1246.407482][T26812] ____sys_sendmsg+0x419/0x850
[ 1246.407484][T26812] ? copy_msghdr_from_user+0x270/0x430
[ 1246.407486][T26812] ? get_timestamp.constprop.0+0x390/0x390
[ 1246.407488][T26812] ? move_addr_to_kernel+0x40/0x40
[ 1246.407491][T26812] ? stack_depot_save_flags+0x30d/0x6e0
[ 1246.407495][T26812] ? rcu_read_lock_any_held+0x3c/0x90
[ 1246.407500][T26812] ___sys_sendmsg+0xfd/0x180
[ 1246.407502][T26812] ? __call_rcu_common.constprop.0+0xa6/0xa00
[ 1246.407505][T26812] ? copy_msghdr_from_user+0x430/0x430
[ 1246.407520][T26812] __sys_sendmsg+0x124/0x1c0
[ 1246.407522][T26812] ? __sys_sendmsg_sock+0x20/0x20
[ 1246.407524][T26812] ? lockdep_hardirqs_on+0x84/0x130
[ 1246.407528][T26812] ? __call_rcu_common.constprop.0+0x3bd/0xa00
[ 1246.407533][T26812] ? do_raw_spin_unlock+0x59/0x250
[ 1246.407536][T26812] ? rcu_is_watching+0x15/0xd0
[ 1246.407539][T26812] do_syscall_64+0x117/0xfc0
[ 1246.407541][T26812] ? exc_page_fault+0xaf/0xd0
[ 1246.407544][T26812] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1246.407546][T26812] RIP: 0033:0x7f7fe0147c5e
[ 1246.407549][T26812] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 1246.407551][T26812] RSP: 002b:00007ffce73c1500 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
[ 1246.407553][T26812] RAX: ffffffffffffffda RBX: 00007ffce73c3b10 RCX: 00007f7fe0147c5e
[ 1246.407555][T26812] RDX: 0000000000000000 RSI: 00007ffce73c15c0 RDI: 0000000000000005
[ 1246.407556][T26812] RBP: 00007ffce73c1510 R08: 0000000000000000 R09: 0000000000000000
[ 1246.407557][T26812] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 1246.407557][T26812] R13: 0000000069bb982b R14: 00007ffce73c3b20 R15: 000000000049c620
[ 1246.407564][T26812] </TASK>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes.
2026-03-19 14:28 ` [PATCH v5 net 0/3] ipv6: Fix two GC issues with permanent routes Jakub Kicinski
@ 2026-03-20 2:18 ` Kuniyuki Iwashima
0 siblings, 0 replies; 6+ messages in thread
From: Kuniyuki Iwashima @ 2026-03-20 2:18 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David Ahern, David S . Miller, Eric Dumazet, Paolo Abeni,
Kui-Feng Lee, Xin Long, Simon Horman, Kuniyuki Iwashima, netdev
On Thu, Mar 19, 2026 at 7:29 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Thu, 19 Mar 2026 04:13:49 +0000 Kuniyuki Iwashima wrote:
> > Patch 1 fixes the unbounded growth of tb6_gc_hlist due to
> > permanent routes whose exception routes have all expired.
> >
> > Patch 2 fixes an issue where exception routes tied to
> > permanent routes are not properly aged.
> >
> > Patch 3 is a selftest for the issue fixed by Patch 2.
>
> Hitting a RCU warning with this:
Ah, I should've run it with lockdep. fib6_gc_all()
calls rcu_read_lock() indeed.
Will wrap fib6_age_exceptions() call in
fib6_may_remove_gc_list() with RCU.
Thanks !
>
> [ 1246.404735][T26812] =============================
> [ 1246.404892][T26812] WARNING: suspicious RCU usage
> [ 1246.405029][T26812] 7.0.0-rc3-virtme #1 Not tainted
> [ 1246.405170][T26812] -----------------------------
> [ 1246.405302][T26812] ./include/net/neighbour.h:312 suspicious rcu_dereference_check() usage!
> [ 1246.405498][T26812]
> [ 1246.405498][T26812] other info that might help us debug this:
> [ 1246.405498][T26812]
> [ 1246.405786][T26812]
> [ 1246.405786][T26812] rcu_scheduler_active = 2, debug_locks = 1
> [ 1246.405988][T26812] 3 locks held by ip/26812:
> [ 1246.406124][T26812] #0: ff11000015e71a30 (&tb->tb6_lock){+.-.}-{3:3}, at: ip6_route_add+0x95/0x160
> [ 1246.406587][T26812] #1: ffffffffbc58c900 (rcu_read_lock_bh){....}-{1:3}, at: fib6_nh_age_exceptions.part.0+0x24/0x200
> [ 1246.406873][T26812] #2: ffffffffbcdafbd8 (rt6_exception_lock){+.-.}-{3:3}, at: fib6_nh_age_exceptions.part.0+0x66/0x200
> [ 1246.407143][T26812]
> [ 1246.407143][T26812] stack backtrace:
> [ 1246.407315][T26812] CPU: 3 UID: 0 PID: 26812 Comm: ip Not tainted 7.0.0-rc3-virtme #1 PREEMPT(full)
> [ 1246.407318][T26812] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 1246.407319][T26812] Call Trace:
> [ 1246.407321][T26812] <TASK>
> [ 1246.407322][T26812] dump_stack_lvl+0x6f/0xa0
> [ 1246.407328][T26812] lockdep_rcu_suspicious.cold+0x4f/0xad
> [ 1246.407334][T26812] ___neigh_lookup_noref.constprop.0+0x4d0/0x8e0
> [ 1246.407339][T26812] rt6_age_examine_exception+0x209/0x510
> [ 1246.407343][T26812] ? __ip6_del_rt+0x160/0x160
> [ 1246.407346][T26812] ? fib6_nh_get_excptn_bucket+0x6e/0x150
> [ 1246.407348][T26812] fib6_nh_age_exceptions.part.0+0xce/0x200
> [ 1246.407352][T26812] rt6_age_exceptions+0xff/0x150
> [ 1246.407355][T26812] ? rt6_flush_exceptions+0x1a0/0x1a0
> [ 1246.407357][T26812] ? rcu_is_watching+0x15/0xd0
> [ 1246.407361][T26812] ? rcu_is_watching+0x15/0xd0
> [ 1246.407363][T26812] fib6_age_exceptions+0xc5/0x250
> [ 1246.407366][T26812] fib6_add_rt2node+0x25c6/0x3f90
> [ 1246.407368][T26812] ? pcpu_alloc_noprof+0x635/0xa60
> [ 1246.407376][T26812] ? fib6_age_exceptions+0x250/0x250
> [ 1246.407379][T26812] ? fib6_add_1.constprop.0+0x512/0x1620
> [ 1246.407385][T26812] ? fib6_add+0x36a/0xe40
> [ 1246.407386][T26812] fib6_add+0x36a/0xe40
> [ 1246.407389][T26812] ? lock_acquire.part.0+0xbc/0x260
> [ 1246.407392][T26812] ? fib6_add_rt2node+0x3f90/0x3f90
> [ 1246.407398][T26812] ip6_route_add+0xa7/0x160
> [ 1246.407400][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
> [ 1246.407402][T26812] inet6_rtm_newroute+0x10a/0x120
> [ 1246.407404][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
> [ 1246.407406][T26812] ? lock_acquire.part.0+0xbc/0x260
> [ 1246.407407][T26812] ? find_held_lock+0x2b/0x80
> [ 1246.407415][T26812] ? __lock_release.isra.0+0x59/0x170
> [ 1246.407418][T26812] ? rtnetlink_rcv_msg+0x6dc/0xb90
> [ 1246.407422][T26812] ? ip6_route_multipath_add+0x13a0/0x13a0
> [ 1246.407424][T26812] rtnetlink_rcv_msg+0x6fe/0xb90
> [ 1246.407427][T26812] ? rtnl_fdb_dump+0x620/0x620
> [ 1246.407429][T26812] ? __lock_acquire+0x577/0xc10
> [ 1246.407433][T26812] ? lock_acquire.part.0+0xbc/0x260
> [ 1246.407434][T26812] ? find_held_lock+0x2b/0x80
> [ 1246.407438][T26812] netlink_rcv_skb+0x123/0x380
> [ 1246.407441][T26812] ? rtnl_fdb_dump+0x620/0x620
> [ 1246.407444][T26812] ? netlink_ack+0xce0/0xce0
> [ 1246.407450][T26812] ? netlink_deliver_tap+0xc5/0x330
> [ 1246.407451][T26812] ? netlink_deliver_tap+0x13f/0x330
> [ 1246.407455][T26812] netlink_unicast+0x4a3/0x770
> [ 1246.407458][T26812] ? netlink_attachskb+0x810/0x810
> [ 1246.407460][T26812] ? __alloc_skb+0x4c4/0x5f0
> [ 1246.407463][T26812] ? napi_skb_cache_get+0x7a0/0x7a0
> [ 1246.407465][T26812] ? lock_acquire.part.0+0xbc/0x260
> [ 1246.407467][T26812] ? __lock_acquire+0x577/0xc10
> [ 1246.407470][T26812] netlink_sendmsg+0x735/0xc60
> [ 1246.407473][T26812] ? netlink_unicast+0x770/0x770
> [ 1246.407477][T26812] ? __might_fault+0x97/0x140
> [ 1246.407482][T26812] ____sys_sendmsg+0x419/0x850
> [ 1246.407484][T26812] ? copy_msghdr_from_user+0x270/0x430
> [ 1246.407486][T26812] ? get_timestamp.constprop.0+0x390/0x390
> [ 1246.407488][T26812] ? move_addr_to_kernel+0x40/0x40
> [ 1246.407491][T26812] ? stack_depot_save_flags+0x30d/0x6e0
> [ 1246.407495][T26812] ? rcu_read_lock_any_held+0x3c/0x90
> [ 1246.407500][T26812] ___sys_sendmsg+0xfd/0x180
> [ 1246.407502][T26812] ? __call_rcu_common.constprop.0+0xa6/0xa00
> [ 1246.407505][T26812] ? copy_msghdr_from_user+0x430/0x430
> [ 1246.407520][T26812] __sys_sendmsg+0x124/0x1c0
> [ 1246.407522][T26812] ? __sys_sendmsg_sock+0x20/0x20
> [ 1246.407524][T26812] ? lockdep_hardirqs_on+0x84/0x130
> [ 1246.407528][T26812] ? __call_rcu_common.constprop.0+0x3bd/0xa00
> [ 1246.407533][T26812] ? do_raw_spin_unlock+0x59/0x250
> [ 1246.407536][T26812] ? rcu_is_watching+0x15/0xd0
> [ 1246.407539][T26812] do_syscall_64+0x117/0xfc0
> [ 1246.407541][T26812] ? exc_page_fault+0xaf/0xd0
> [ 1246.407544][T26812] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> [ 1246.407546][T26812] RIP: 0033:0x7f7fe0147c5e
> [ 1246.407549][T26812] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
> [ 1246.407551][T26812] RSP: 002b:00007ffce73c1500 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
> [ 1246.407553][T26812] RAX: ffffffffffffffda RBX: 00007ffce73c3b10 RCX: 00007f7fe0147c5e
> [ 1246.407555][T26812] RDX: 0000000000000000 RSI: 00007ffce73c15c0 RDI: 0000000000000005
> [ 1246.407556][T26812] RBP: 00007ffce73c1510 R08: 0000000000000000 R09: 0000000000000000
> [ 1246.407557][T26812] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
> [ 1246.407557][T26812] R13: 0000000069bb982b R14: 00007ffce73c3b20 R15: 000000000049c620
> [ 1246.407564][T26812] </TASK>
^ permalink raw reply [flat|nested] 6+ messages in thread