[PATCH net] net: protect negative destination advice with RCU

[PATCH net] net: protect negative destination advice with RCU

[Eric Dumazet]

From: Kyle Zeng <kylebot@openai.com>

SO_CNX_ADVICE calls __dst_negative_advice() while holding the socket
lock. Connected UDP sends can still invalidate or replace sk_dst_cache
without that lock. A concurrent sk_dst_check() can drop the final
destination reference and allow an RCU callback to destroy it while
__dst_negative_advice() retains only a borrowed pointer. This can cause
a use-after-free while accessing dst->ops or running the negative_advice
callback.

The writer-side ordering fixed by commit 92f1655aa2b2 ("net: fix
__dst_negative_advice() race") does not protect this reader from an
independent cache replacement.

Hold an RCU read-side critical section across the lookup and callback.
This follows the datagram release callbacks and covers IPv4, IPv6, and
XFRM advice without changing cache-reset or reference-ownership rules.

Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 include/net/sock.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 173b37b2b8bb..0c1a6895d347 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2218,10 +2218,13 @@ sk_dst_get(const struct sock *sk)
 
 static inline void __dst_negative_advice(struct sock *sk)
 {
-	struct dst_entry *dst = __sk_dst_get(sk);
+	struct dst_entry *dst;
 
+	rcu_read_lock();
+	dst = __sk_dst_get(sk);
 	if (dst && dst->ops->negative_advice)
 		dst->ops->negative_advice(sk, dst);
+	rcu_read_unlock();
 }
 
 static inline void dst_negative_advice(struct sock *sk)
-- 
2.53.0

Re: [PATCH net] net: protect negative destination advice with RCU

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net: protect negative destination advice with RCU

[Kuniyuki Iwashima]

On Wed, 04 Nov 2026 14:17:44 +0100, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> SO_CNX_ADVICE calls __dst_negative_advice() while holding the socket
> lock. Connected UDP sends can still invalidate or replace sk_dst_cache
> without that lock. A concurrent sk_dst_check() can drop the final
> destination reference and allow an RCU callback to destroy it while
> __dst_negative_advice() retains only a borrowed pointer. This can cause
> a use-after-free while accessing dst->ops or running the negative_advice
> callback.
> 
> The writer-side ordering fixed by commit 92f1655aa2b2 ("net: fix
> __dst_negative_advice() race") does not protect this reader from an
> independent cache replacement.
> 
> Hold an RCU read-side critical section across the lookup and callback.
> This follows the datagram release callbacks and covers IPv4, IPv6, and
> XFRM advice without changing cache-reset or reference-ownership rules.
> 
> Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>