* Re: [PATCH 6.6 438/567] net: use dst_dev_rcu() in sk_setup_caps()
[not found] ` <20260323134544.788448840@linuxfoundation.org>
@ 2026-03-24 10:00 ` Matthieu Baerts
2026-03-24 10:32 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Matthieu Baerts @ 2026-03-24 10:00 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, edumazet, kuniyu, kuba, dsahern, netdev, Ruohan Lan,
Eric Dumazet, David Ahern, Jakub Kicinski
Hi Greg, Ruohan,
On 23/03/2026 14:45, Greg Kroah-Hartman wrote:
> 6.6-stable review patch. If anyone has any objections, please let me know.
I do!
> ------------------
>
> From: Eric Dumazet <edumazet@google.com>
>
> [ Upstream commit 99a2ace61b211b0be861b07fbaa062fca4b58879 ]
>
> Use RCU to protect accesses to dst->dev from sk_setup_caps()
> and sk_dst_gso_max_size().
>
> Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(),
> and ip_dst_mtu_maybe_forward().
>
> ip4_dst_hoplimit() can use dst_dev_net_rcu().
>
> Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reviewed-by: David Ahern <dsahern@kernel.org>
> Link: https://patch.msgid.link/20250828195823.3958522-6-edumazet@google.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> [ Adjust context ]
It looks like more adjustments are required: with this patch, running
the MPTCP 'diag.sh' selftest using kernel/configs/debug.config causes
this warning:
=============================
WARNING: suspicious RCU usage
6.6.129 #1 Tainted: G N
-----------------------------
include/net/dst.h:577 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by mptcp_connect/213:
#0: ffff88810f9b0130 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect (net/ipv4/af_inet.c:747)
#1: ffff88810fe28130 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: mptcp_connect (net/mptcp/protocol.c:3883)
stack backtrace:
CPU: 3 PID: 213 Comm: mptcp_connect Tainted: G N 6.6.129 #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:107)
lockdep_rcu_suspicious (include/linux/context_tracking.h:153)
ip_dst_mtu_maybe_forward.constprop.0 (include/net/dst.h:577 (discriminator 13))
? __build_flow_key.constprop.0 (include/net/ip.h:457)
? __lock_acquire (kernel/locking/lockdep.c:5719)
? tcp_mtup_init (net/ipv4/tcp_output.c:1779 (discriminator 4))
tcp_connect_init (net/ipv4/tcp_output.c:3804 (discriminator 1))
? tcp_sync_mss (net/ipv4/tcp_output.c:3786)
? ipv4_dst_check (net/ipv4/route.c:1232)
? __sk_dst_check (net/core/sock.c:601 (discriminator 2))
? inet_sk_rebuild_header (net/ipv4/af_inet.c:1316)
? reacquire_held_locks (kernel/locking/lockdep.c:5405)
? __lock_acquire (kernel/locking/lockdep.c:5719)
tcp_connect (net/ipv4/tcp_output.c:3986)
? mark_held_locks (kernel/locking/lockdep.c:4274 (discriminator 1))
? tcp_send_syn_data (net/ipv4/tcp_output.c:3974)
? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:62 (discriminator 1))
tcp_v4_connect (net/ipv4/tcp_ipv4.c:335 (discriminator 1))
? trace_tcp_bad_csum (net/ipv4/tcp_ipv4.c:214)
mptcp_connect (net/mptcp/protocol.c:3892)
__inet_stream_connect (net/ipv4/af_inet.c:676)
? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4300)
inet_stream_connect (net/ipv4/af_inet.c:748)
__sys_connect (net/socket.c:2056 (discriminator 2))
? __sys_connect_file (net/socket.c:2063)
? update_socket_protocol+0x10/0x10
__x64_sys_connect (net/socket.c:2083 (discriminator 1))
? syscall_enter_from_user_mode (arch/x86/include/asm/irqflags.h:42)
do_syscall_64 (arch/x86/entry/common.c:46 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f2b23041186
Code: 47 ba 04 00 00 00 48 8b 05 87 3c 19 00 64 89 10 48 c7 c2 ff ff ff ff c9 48 89 d0 c3 0f 1f 84 00 00 00 00 00 48 8b 45 10 0f 05 <48> 89 c2 48 3d 00 f0 ff ff 77 0f c9 48 89 d0 c3 66 2e 0f 1f 84 00
All code
========
0: 47 ba 04 00 00 00 rex.RXB mov $0x4,%r10d
6: 48 8b 05 87 3c 19 00 mov 0x193c87(%rip),%rax # 0x193c94
d: 64 89 10 mov %edx,%fs:(%rax)
10: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
17: c9 leave
18: 48 89 d0 mov %rdx,%rax
1b: c3 ret
1c: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
23: 00
24: 48 8b 45 10 mov 0x10(%rbp),%rax
28: 0f 05 syscall
2a:* 48 89 c2 mov %rax,%rdx <-- trapping instruction
2d: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
33: 77 0f ja 0x44
35: c9 leave
36: 48 89 d0 mov %rdx,%rax
39: c3 ret
3a: 66 data16
3b: 2e cs
3c: 0f .byte 0xf
3d: 1f (bad)
3e: 84 00 test %al,(%rax)
Code starting with the faulting instruction
===========================================
0: 48 89 c2 mov %rax,%rdx
3: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
9: 77 0f ja 0x1a
b: c9 leave
c: 48 89 d0 mov %rdx,%rax
f: c3 ret
10: 66 data16
11: 2e cs
12: 0f .byte 0xf
13: 1f (bad)
14: 84 00 test %al,(%rax)
RSP: 002b:00007fff4638afa0 EFLAGS: 00000202 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2b23041186
RDX: 0000000000000010 RSI: 0000557a15fd7360 RDI: 0000000000000003
RBP: 00007fff4638afb0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000106
R13: 000000000000000a R14: 00007f2b2328a000 R15: 0000557a15fd7330
</TASK>
=============================
WARNING: suspicious RCU usage
6.6.129 #1 Tainted: G N
-----------------------------
include/net/net_namespace.h:411 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by mptcp_connect/213:
#0: ffff88810f9b0130 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect (net/ipv4/af_inet.c:747)
#1: ffff88810fe28130 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: mptcp_connect (net/mptcp/protocol.c:3883)
stack backtrace:
CPU: 3 PID: 213 Comm: mptcp_connect Tainted: G N 6.6.129 #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:107)
lockdep_rcu_suspicious (include/linux/context_tracking.h:153)
ip_dst_mtu_maybe_forward.constprop.0 (include/net/net_namespace.h:411 (discriminator 13))
? __build_flow_key.constprop.0 (include/net/ip.h:457)
? __lock_acquire (kernel/locking/lockdep.c:5719)
? tcp_mtup_init (net/ipv4/tcp_output.c:1779 (discriminator 4))
tcp_connect_init (net/ipv4/tcp_output.c:3804 (discriminator 1))
? tcp_sync_mss (net/ipv4/tcp_output.c:3786)
? ipv4_dst_check (net/ipv4/route.c:1232)
? __sk_dst_check (net/core/sock.c:601 (discriminator 2))
? inet_sk_rebuild_header (net/ipv4/af_inet.c:1316)
? reacquire_held_locks (kernel/locking/lockdep.c:5405)
? __lock_acquire (kernel/locking/lockdep.c:5719)
tcp_connect (net/ipv4/tcp_output.c:3986)
? mark_held_locks (kernel/locking/lockdep.c:4274 (discriminator 1))
? tcp_send_syn_data (net/ipv4/tcp_output.c:3974)
? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:62 (discriminator 1))
tcp_v4_connect (net/ipv4/tcp_ipv4.c:335 (discriminator 1))
? trace_tcp_bad_csum (net/ipv4/tcp_ipv4.c:214)
mptcp_connect (net/mptcp/protocol.c:3892)
__inet_stream_connect (net/ipv4/af_inet.c:676)
? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4300)
inet_stream_connect (net/ipv4/af_inet.c:748)
__sys_connect (net/socket.c:2056 (discriminator 2))
? __sys_connect_file (net/socket.c:2063)
? update_socket_protocol+0x10/0x10
__x64_sys_connect (net/socket.c:2083 (discriminator 1))
? syscall_enter_from_user_mode (arch/x86/include/asm/irqflags.h:42)
do_syscall_64 (arch/x86/entry/common.c:46 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f2b23041186
Code: 47 ba 04 00 00 00 48 8b 05 87 3c 19 00 64 89 10 48 c7 c2 ff ff ff ff c9 48 89 d0 c3 0f 1f 84 00 00 00 00 00 48 8b 45 10 0f 05 <48> 89 c2 48 3d 00 f0 ff ff 77 0f c9 48 89 d0 c3 66 2e 0f 1f 84 00
All code
========
0: 47 ba 04 00 00 00 rex.RXB mov $0x4,%r10d
6: 48 8b 05 87 3c 19 00 mov 0x193c87(%rip),%rax # 0x193c94
d: 64 89 10 mov %edx,%fs:(%rax)
10: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
17: c9 leave
18: 48 89 d0 mov %rdx,%rax
1b: c3 ret
1c: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
23: 00
24: 48 8b 45 10 mov 0x10(%rbp),%rax
28: 0f 05 syscall
2a:* 48 89 c2 mov %rax,%rdx <-- trapping instruction
2d: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
33: 77 0f ja 0x44
35: c9 leave
36: 48 89 d0 mov %rdx,%rax
39: c3 ret
3a: 66 data16
3b: 2e cs
3c: 0f .byte 0xf
3d: 1f (bad)
3e: 84 00 test %al,(%rax)
Code starting with the faulting instruction
===========================================
0: 48 89 c2 mov %rax,%rdx
3: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
9: 77 0f ja 0x1a
b: c9 leave
c: 48 89 d0 mov %rdx,%rax
f: c3 ret
10: 66 data16
11: 2e cs
12: 0f .byte 0xf
13: 1f (bad)
14: 84 00 test %al,(%rax)
RSP: 002b:00007fff4638afa0 EFLAGS: 00000202 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2b23041186
RDX: 0000000000000010 RSI: 0000557a15fd7360 RDI: 0000000000000003
RBP: 00007fff4638afb0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000106
R13: 000000000000000a R14: 00007f2b2328a000 R15: 0000557a15fd7330
</TASK>
@Greg: Is it possible to drop this patch for the moment?
(This patch was probably coming with dependences.)
@Ruohan: do you mind looking at this please?
I didn't execute TCP specific tests, only MPTCP ones.
See: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/23479015653/job/68317986391
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply [flat|nested] 2+ messages in thread