[PATCH net 0/8] net: second round to use dev_net_rcu()

[PATCH net 0/8] net: second round to use dev_net_rcu()

[Eric Dumazet]

dev_net(dev) should either be protected by RTNL or RCU.

There is no LOCKDEP support yet for this helper.

Adding it would trigger too many splats.

This second series fixes some of them.

Eric Dumazet (8):
  ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  ndisc: use RCU protection in ndisc_alloc_skb()
  neighbour: use RCU protection in __neigh_notify()
  arp: use RCU protection in arp_xmit()
  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  vrf: use RCU protection in l3mdev_l3_out()
  ndisc: extend RCU protection in ndisc_send_skb()
  ipv6: mcast: extend RCU protection in igmp6_send()

 include/net/l3mdev.h       |  2 ++
 net/core/neighbour.c       |  8 ++++++--
 net/ipv4/arp.c             |  4 +++-
 net/ipv6/mcast.c           | 31 +++++++++++++++----------------
 net/ipv6/ndisc.c           | 24 +++++++++++++-----------
 net/openvswitch/datapath.c | 12 +++++++++---
 6 files changed, 48 insertions(+), 33 deletions(-)

-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 1/8] ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()

[Eric Dumazet]

ndisc_send_redirect() is called under RCU protection, not RTNL.

It must use dev_get_by_index_rcu() instead of __dev_get_by_index()

Fixes: 2f17becfbea5 ("vrf: check the original netdevice for generating redirect")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
---
 net/ipv6/ndisc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d044c67019de6da1eb29dee875cf8cda30210ceb..264b10a94757705d4ce61e1371eb4d9a699b9016 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1694,7 +1694,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
 	bool ret;
 
 	if (netif_is_l3_master(skb->dev)) {
-		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
+		dev = dev_get_by_index_rcu(dev_net(skb->dev), IPCB(skb)->iif);
 		if (!dev)
 			return;
 	}
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 2/8] ndisc: use RCU protection in ndisc_alloc_skb()

[Eric Dumazet]

ndisc_alloc_skb() can be called without RTNL or RCU being held.

Add RCU protection to avoid possible UAF.

Fixes: de09334b9326 ("ndisc: Introduce ndisc_alloc_skb() helper.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ndisc.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 264b10a94757705d4ce61e1371eb4d9a699b9016..90f8aa2d7af2ec1103220378c155b7b724efc575 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -418,15 +418,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 {
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 	struct sk_buff *skb;
 
 	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
-	if (!skb) {
-		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
-			  __func__);
+	if (!skb)
 		return NULL;
-	}
 
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;
@@ -437,7 +433,9 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 	/* Manually assign socket ownership as we avoid calling
 	 * sock_alloc_send_pskb() to bypass wmem buffer limits
 	 */
-	skb_set_owner_w(skb, sk);
+	rcu_read_lock();
+	skb_set_owner_w(skb, dev_net_rcu(dev)->ipv6.ndisc_sk);
+	rcu_read_unlock();
 
 	return skb;
 }
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 3/8] neighbour: use RCU protection in __neigh_notify()

[Eric Dumazet]

__neigh_notify() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.

Fixes: 426b5303eb43 ("[NETNS]: Modify the neighbour table code so it handles multiple network namespaces")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/core/neighbour.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 89656d180bc60c57516d56be69774ed0c7b352b2..bd0251bd74a1f8e08543642e5dc938ed2c5fdfda 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -3447,10 +3447,12 @@ static const struct seq_operations neigh_stat_seq_ops = {
 static void __neigh_notify(struct neighbour *n, int type, int flags,
 			   u32 pid)
 {
-	struct net *net = dev_net(n->dev);
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
+	struct net *net;
 
+	rcu_read_lock();
+	net = dev_net_rcu(n->dev);
 	skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
 	if (skb == NULL)
 		goto errout;
@@ -3463,9 +3465,11 @@ static void __neigh_notify(struct neighbour *n, int type, int flags,
 		goto errout;
 	}
 	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
-	return;
+	goto out;
 errout:
 	rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
+out:
+	rcu_read_unlock();
 }
 
 void neigh_app_ns(struct neighbour *n)
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 4/8] arp: use RCU protection in arp_xmit()

[Eric Dumazet]

arp_xmit() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.

Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/arp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index cb9a7ed8abd3ab17403f226ea7e31ea2bae52a9f..f23a1ec6694cb2f1bd60f28faa357fcad83c165a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -659,10 +659,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb
  */
 void arp_xmit(struct sk_buff *skb)
 {
+	rcu_read_lock();
 	/* Send it off, maybe filter it using firewalling first.  */
 	NF_HOOK(NFPROTO_ARP, NF_ARP_OUT,
-		dev_net(skb->dev), NULL, skb, NULL, skb->dev,
+		dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev,
 		arp_xmit_finish);
+	rcu_read_unlock();
 }
 EXPORT_SYMBOL(arp_xmit);
 
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 5/8] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()

[Eric Dumazet]

ovs_vport_cmd_fill_info() can be called without RTNL or RCU.

Use RCU protection and dev_net_rcu() to avoid potential UAF.

Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/openvswitch/datapath.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 225f6048867f4a396f6411c50b0cdf9437303e97..5d548eda742dfc43fcd3d07458704ee9b7e9ed64 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2101,6 +2101,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
 {
 	struct ovs_header *ovs_header;
 	struct ovs_vport_stats vport_stats;
+	struct net *net_vport;
 	int err;
 
 	ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family,
@@ -2117,12 +2118,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
 	    nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex))
 		goto nla_put_failure;
 
-	if (!net_eq(net, dev_net(vport->dev))) {
-		int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
+	rcu_read_lock();
+	net_vport = dev_net_rcu(vport->dev);
+	if (!net_eq(net, net_vport)) {
+		int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC);
 
 		if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
-			goto nla_put_failure;
+			goto nla_put_failure_unlock;
 	}
+	rcu_read_unlock();
 
 	ovs_vport_get_stats(vport, &vport_stats);
 	if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS,
@@ -2143,6 +2147,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
 	genlmsg_end(skb, ovs_header);
 	return 0;
 
+nla_put_failure_unlock:
+	rcu_read_unlock();
 nla_put_failure:
 	err = -EMSGSIZE;
 error:
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 6/8] vrf: use RCU protection in l3mdev_l3_out()

[Eric Dumazet]

l3mdev_l3_out() can be called without RCU being held:

raw_sendmsg()
 ip_push_pending_frames()
  ip_send_skb()
   ip_local_out()
    __ip_local_out()
     l3mdev_ip_out()

Add rcu_read_lock() / rcu_read_unlock() pair to avoid
a potential UAF.

Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 include/net/l3mdev.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h
index 2d6141f28b53097fe452cbdaf5faa977fc6e6782..f7fe796e8429a5e633f7540430675a728ed4de66 100644
--- a/include/net/l3mdev.h
+++ b/include/net/l3mdev.h
@@ -198,10 +198,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto)
 	if (netif_is_l3_slave(dev)) {
 		struct net_device *master;
 
+		rcu_read_lock();
 		master = netdev_master_upper_dev_get_rcu(dev);
 		if (master && master->l3mdev_ops->l3mdev_l3_out)
 			skb = master->l3mdev_ops->l3mdev_l3_out(master, sk,
 								skb, proto);
+		rcu_read_unlock();
 	}
 
 	return skb;
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 7/8] ndisc: extend RCU protection in ndisc_send_skb()

[Eric Dumazet]

ndisc_send_skb() can be called without RTNL or RCU held.

Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu()
and avoid a potential UAF.

Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ndisc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 90f8aa2d7af2ec1103220378c155b7b724efc575..8699d1a188dc4a15ac0b65229c4dd19240c9c054 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -471,16 +471,20 @@ static void ip6_nd_hdr(struct sk_buff *skb,
 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 		    const struct in6_addr *saddr)
 {
+	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 	struct dst_entry *dst = skb_dst(skb);
-	struct net *net = dev_net(skb->dev);
-	struct sock *sk = net->ipv6.ndisc_sk;
 	struct inet6_dev *idev;
+	struct net *net;
+	struct sock *sk;
 	int err;
-	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 	u8 type;
 
 	type = icmp6h->icmp6_type;
 
+	rcu_read_lock();
+
+	net = dev_net_rcu(skb->dev);
+	sk = net->ipv6.ndisc_sk;
 	if (!dst) {
 		struct flowi6 fl6;
 		int oif = skb->dev->ifindex;
@@ -488,6 +492,7 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 		dst = icmp6_dst_alloc(skb->dev, &fl6);
 		if (IS_ERR(dst)) {
+			rcu_read_unlock();
 			kfree_skb(skb);
 			return;
 		}
@@ -502,7 +507,6 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 
 	ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
 
-	rcu_read_lock();
 	idev = __in6_dev_get(dst->dev);
 	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 
-- 
2.48.1.502.g6dc24dfdaf-goog

[PATCH net 8/8] ipv6: mcast: extend RCU protection in igmp6_send()

[Eric Dumazet]

igmp6_send() can be called without RTNL or RCU being held.

Extend RCU protection so that we can safely fetch the net pointer
and avoid a potential UAF.

Note that we no longer can use sock_alloc_send_skb() because
ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk
socket under RCU protection.

Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/mcast.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 9dfdb40988b0f8edd882c07b555ea0115ee95cab..81a739ebf7094694a6f5de5020cd4c4d1c9642d1 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2165,21 +2165,21 @@ static void mld_send_cr(struct inet6_dev *idev)
 
 static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 {
-	struct net *net = dev_net(dev);
-	struct sock *sk = net->ipv6.igmp_sk;
+	const struct in6_addr *snd_addr, *saddr;
+	int err, len, payload_len, full_len;
+	struct in6_addr addr_buf;
 	struct inet6_dev *idev;
 	struct sk_buff *skb;
 	struct mld_msg *hdr;
-	const struct in6_addr *snd_addr, *saddr;
-	struct in6_addr addr_buf;
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	int err, len, payload_len, full_len;
 	u8 ra[8] = { IPPROTO_ICMPV6, 0,
 		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
 		     IPV6_TLV_PADN, 0 };
-	struct flowi6 fl6;
 	struct dst_entry *dst;
+	struct flowi6 fl6;
+	struct net *net;
+	struct sock *sk;
 
 	if (type == ICMPV6_MGM_REDUCTION)
 		snd_addr = &in6addr_linklocal_allrouters;
@@ -2190,19 +2190,21 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 	payload_len = len + sizeof(ra);
 	full_len = sizeof(struct ipv6hdr) + payload_len;
 
-	rcu_read_lock();
-	IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_OUTREQUESTS);
-	rcu_read_unlock();
+	skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL);
 
-	skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);
+	rcu_read_lock();
 
+	net = dev_net_rcu(dev);
+	idev = __in6_dev_get(dev);
+	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 	if (!skb) {
-		rcu_read_lock();
-		IP6_INC_STATS(net, __in6_dev_get(dev),
-			      IPSTATS_MIB_OUTDISCARDS);
+		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
 		rcu_read_unlock();
 		return;
 	}
+	sk = net->ipv6.igmp_sk;
+	skb_set_owner_w(skb, sk);
+
 	skb->priority = TC_PRIO_CONTROL;
 	skb_reserve(skb, hlen);
 
@@ -2227,9 +2229,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 					 IPPROTO_ICMPV6,
 					 csum_partial(hdr, len, 0));
 
-	rcu_read_lock();
-	idev = __in6_dev_get(skb->dev);
-
 	icmpv6_flow_init(sk, &fl6, type,
 			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
 			 skb->dev->ifindex);
-- 
2.48.1.502.g6dc24dfdaf-goog

Re: [PATCH net 1/8] ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> ndisc_send_redirect() is called under RCU protection, not RTNL.
> 
> It must use dev_get_by_index_rcu() instead of __dev_get_by_index()
> 
> Fixes: 2f17becfbea5 ("vrf: check the original netdevice for generating redirect")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
> ---
>  net/ipv6/ndisc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 2/8] ndisc: use RCU protection in ndisc_alloc_skb()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> ndisc_alloc_skb() can be called without RTNL or RCU being held.
> 
> Add RCU protection to avoid possible UAF.
> 
> Fixes: de09334b9326 ("ndisc: Introduce ndisc_alloc_skb() helper.")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv6/ndisc.c | 10 ++++------
>  1 file changed, 4 insertions(+), 6 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 3/8] neighbour: use RCU protection in __neigh_notify()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> __neigh_notify() can be called without RTNL or RCU protection.
> 
> Use RCU protection to avoid potential UAF.
> 
> Fixes: 426b5303eb43 ("[NETNS]: Modify the neighbour table code so it handles multiple network namespaces")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/core/neighbour.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 4/8] arp: use RCU protection in arp_xmit()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> arp_xmit() can be called without RTNL or RCU protection.
> 
> Use RCU protection to avoid potential UAF.
> 
> Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv4/arp.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 6/8] vrf: use RCU protection in l3mdev_l3_out()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> l3mdev_l3_out() can be called without RCU being held:
> 
> raw_sendmsg()
>  ip_push_pending_frames()
>   ip_send_skb()
>    ip_local_out()
>     __ip_local_out()
>      l3mdev_ip_out()
> 
> Add rcu_read_lock() / rcu_read_unlock() pair to avoid
> a potential UAF.
> 
> Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  include/net/l3mdev.h | 2 ++
>  1 file changed, 2 insertions(+)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 7/8] ndisc: extend RCU protection in ndisc_send_skb()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> ndisc_send_skb() can be called without RTNL or RCU held.
> 
> Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu()
> and avoid a potential UAF.
> 
> Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv6/ndisc.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 8/8] ipv6: mcast: extend RCU protection in igmp6_send()

[David Ahern]

On 2/7/25 6:58 AM, Eric Dumazet wrote:
> igmp6_send() can be called without RTNL or RCU being held.
> 
> Extend RCU protection so that we can safely fetch the net pointer
> and avoid a potential UAF.
> 
> Note that we no longer can use sock_alloc_send_skb() because
> ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.
> 
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk
> socket under RCU protection.
> 
> Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/ipv6/mcast.c | 31 +++++++++++++++----------------
>  1 file changed, 15 insertions(+), 16 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net 1/8] ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:33 +0000
> ndisc_send_redirect() is called under RCU protection, not RTNL.
> 
> It must use dev_get_by_index_rcu() instead of __dev_get_by_index()
> 
> Fixes: 2f17becfbea5 ("vrf: check the original netdevice for generating redirect")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 2/8] ndisc: use RCU protection in ndisc_alloc_skb()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:34 +0000
> ndisc_alloc_skb() can be called without RTNL or RCU being held.
> 
> Add RCU protection to avoid possible UAF.
> 
> Fixes: de09334b9326 ("ndisc: Introduce ndisc_alloc_skb() helper.")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 3/8] neighbour: use RCU protection in __neigh_notify()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:35 +0000
> __neigh_notify() can be called without RTNL or RCU protection.
> 
> Use RCU protection to avoid potential UAF.
> 
> Fixes: 426b5303eb43 ("[NETNS]: Modify the neighbour table code so it handles multiple network namespaces")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 4/8] arp: use RCU protection in arp_xmit()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:36 +0000
> arp_xmit() can be called without RTNL or RCU protection.
> 
> Use RCU protection to avoid potential UAF.
> 
> Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 5/8] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:37 +0000
> ovs_vport_cmd_fill_info() can be called without RTNL or RCU.
> 
> Use RCU protection and dev_net_rcu() to avoid potential UAF.
> 
> Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 6/8] vrf: use RCU protection in l3mdev_l3_out()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:38 +0000
> l3mdev_l3_out() can be called without RCU being held:
> 
> raw_sendmsg()
>  ip_push_pending_frames()
>   ip_send_skb()
>    ip_local_out()
>     __ip_local_out()
>      l3mdev_ip_out()
> 
> Add rcu_read_lock() / rcu_read_unlock() pair to avoid
> a potential UAF.
> 
> Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

I wondered why syzbot didn't notice this and I confirmed that
list_first_or_null_rcu() doesn't have RCU annotation.

Re: [PATCH net 7/8] ndisc: extend RCU protection in ndisc_send_skb()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:39 +0000
> ndisc_send_skb() can be called without RTNL or RCU held.
> 
> Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu()
> and avoid a potential UAF.
> 
> Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 8/8] ipv6: mcast: extend RCU protection in igmp6_send()

[Kuniyuki Iwashima]

From: Eric Dumazet <edumazet@google.com>
Date: Fri,  7 Feb 2025 13:58:40 +0000
> igmp6_send() can be called without RTNL or RCU being held.
> 
> Extend RCU protection so that we can safely fetch the net pointer
> and avoid a potential UAF.
> 
> Note that we no longer can use sock_alloc_send_skb() because
> ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.
> 
> Instead use alloc_skb() and charge the net->ipv6.igmp_sk
> socket under RCU protection.
> 
> Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

Re: [PATCH net 0/8] net: second round to use dev_net_rcu()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  7 Feb 2025 13:58:32 +0000 you wrote:
> dev_net(dev) should either be protected by RTNL or RCU.
> 
> There is no LOCKDEP support yet for this helper.
> 
> Adding it would trigger too many splats.
> 
> This second series fixes some of them.
> 
> [...]

Here is the summary with links:
  - [net,1/8] ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
    https://git.kernel.org/netdev/net/c/48145a57d4bb
  - [net,2/8] ndisc: use RCU protection in ndisc_alloc_skb()
    https://git.kernel.org/netdev/net/c/628e6d18930b
  - [net,3/8] neighbour: use RCU protection in __neigh_notify()
    https://git.kernel.org/netdev/net/c/becbd5850c03
  - [net,4/8] arp: use RCU protection in arp_xmit()
    https://git.kernel.org/netdev/net/c/a42b69f69216
  - [net,5/8] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
    https://git.kernel.org/netdev/net/c/90b2f49a502f
  - [net,6/8] vrf: use RCU protection in l3mdev_l3_out()
    https://git.kernel.org/netdev/net/c/6d0ce46a9313
  - [net,7/8] ndisc: extend RCU protection in ndisc_send_skb()
    https://git.kernel.org/netdev/net/c/ed6ae1f325d3
  - [net,8/8] ipv6: mcast: extend RCU protection in igmp6_send()
    https://git.kernel.org/netdev/net/c/087c1faa594f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html