[PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[Eric Dumazet]

syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
in an interesting way [1]

Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
list->prev, while the prior write on list->next went well.

static inline void INIT_LIST_HEAD(struct list_head *list)
{
	WRITE_ONCE(list->next, list); // This went well
	WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
}

Issue here is that rt6_uncached_list_del() did not attempt to lock
ul->lock, as list_empty(&rt->dst.rt_uncached) returned
true because the WRITE_ONCE(list->next, list) happened on the other CPU.

We might use list_del_init_careful() and list_empty_careful(),
or make sure rt6_uncached_list_del() always grabs the spinlock
whenever rt->dst.rt_uncached_list has been set.

A similar fix is neeed for IPv4.

[1]

 BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD include/linux/list.h:46 [inline]
 BUG: KASAN: slab-use-after-free in list_del_init include/linux/list.h:296 [inline]
 BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline]
 BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020
Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450

CPU: 0 UID: 0 PID: 3450 Comm: kworker/u8:14 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
  print_address_description mm/kasan/report.c:378 [inline]
  print_report+0xca/0x240 mm/kasan/report.c:482
  kasan_report+0x118/0x150 mm/kasan/report.c:595
  INIT_LIST_HEAD include/linux/list.h:46 [inline]
  list_del_init include/linux/list.h:296 [inline]
  rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline]
  rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020
  addrconf_ifdown+0x143/0x18a0 net/ipv6/addrconf.c:3853
 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
  notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
  call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
  call_netdevice_notifiers net/core/dev.c:2282 [inline]
  netif_close_many+0x29c/0x410 net/core/dev.c:1785
  unregister_netdevice_many_notify+0xb50/0x2330 net/core/dev.c:12353
  ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
  ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:248
  cleanup_net+0x4de/0x7b0 net/core/net_namespace.c:696
  process_one_work kernel/workqueue.c:3257 [inline]
  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 803:
  kasan_save_stack mm/kasan/common.c:57 [inline]
  kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
  unpoison_slab_object mm/kasan/common.c:340 [inline]
  __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
  kasan_slab_alloc include/linux/kasan.h:253 [inline]
  slab_post_alloc_hook mm/slub.c:4953 [inline]
  slab_alloc_node mm/slub.c:5263 [inline]
  kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270
  dst_alloc+0x105/0x170 net/core/dst.c:89
  ip6_dst_alloc net/ipv6/route.c:342 [inline]
  icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333
  mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844
  mld_send_cr net/ipv6/mcast.c:2154 [inline]
  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
  process_one_work kernel/workqueue.c:3257 [inline]
  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Freed by task 20:
  kasan_save_stack mm/kasan/common.c:57 [inline]
  kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
  kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
  poison_slab_object mm/kasan/common.c:253 [inline]
  __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
  kasan_slab_free include/linux/kasan.h:235 [inline]
  slab_free_hook mm/slub.c:2540 [inline]
  slab_free mm/slub.c:6670 [inline]
  kmem_cache_free+0x18f/0x8d0 mm/slub.c:6781
  dst_destroy+0x235/0x350 net/core/dst.c:121
  rcu_do_batch kernel/rcu/tree.c:2605 [inline]
  rcu_core kernel/rcu/tree.c:2857 [inline]
  rcu_cpu_kthread+0xba5/0x1af0 kernel/rcu/tree.c:2945
  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Last potentially related work creation:
  kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
  kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
  __call_rcu_common kernel/rcu/tree.c:3119 [inline]
  call_rcu+0xee/0x890 kernel/rcu/tree.c:3239
  refdst_drop include/net/dst.h:266 [inline]
  skb_dst_drop include/net/dst.h:278 [inline]
  skb_release_head_state+0x71/0x360 net/core/skbuff.c:1156
  skb_release_all net/core/skbuff.c:1180 [inline]
  __kfree_skb net/core/skbuff.c:1196 [inline]
  sk_skb_reason_drop+0xe9/0x170 net/core/skbuff.c:1234
  kfree_skb_reason include/linux/skbuff.h:1322 [inline]
  tcf_kfree_skb_list include/net/sch_generic.h:1127 [inline]
  __dev_xmit_skb net/core/dev.c:4260 [inline]
  __dev_queue_xmit+0x26aa/0x3210 net/core/dev.c:4785
  NF_HOOK_COND include/linux/netfilter.h:307 [inline]
  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
  mld_send_cr net/ipv6/mcast.c:2154 [inline]
  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
  process_one_work kernel/workqueue.c:3257 [inline]
  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

The buggy address belongs to the object at ffff8880294cfa00
 which belongs to the cache ip6_dst_cache of size 232
The buggy address is located 120 bytes inside of
 freed 232-byte region [ffff8880294cfa00, ffff8880294cfae8)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294cf
memcg:ffff88803536b781
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88802ff1c8c0 ffffea0000bf2bc0 dead000000000006
raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88803536b781
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9, tgid 9 (kworker/0:0), ts 91119585830, free_ts 91088628818
  set_page_owner include/linux/page_owner.h:32 [inline]
  post_alloc_hook+0x234/0x290 mm/page_alloc.c:1857
  prep_new_page mm/page_alloc.c:1865 [inline]
  get_page_from_freelist+0x28c0/0x2960 mm/page_alloc.c:3915
  __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210
  alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486
  alloc_slab_page mm/slub.c:3075 [inline]
  allocate_slab+0x86/0x3b0 mm/slub.c:3248
  new_slab mm/slub.c:3302 [inline]
  ___slab_alloc+0xb10/0x13e0 mm/slub.c:4656
  __slab_alloc+0xc6/0x1f0 mm/slub.c:4779
  __slab_alloc_node mm/slub.c:4855 [inline]
  slab_alloc_node mm/slub.c:5251 [inline]
  kmem_cache_alloc_noprof+0x101/0x6c0 mm/slub.c:5270
  dst_alloc+0x105/0x170 net/core/dst.c:89
  ip6_dst_alloc net/ipv6/route.c:342 [inline]
  icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333
  mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844
  mld_send_cr net/ipv6/mcast.c:2154 [inline]
  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
  process_one_work kernel/workqueue.c:3257 [inline]
  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
page last free pid 5859 tgid 5859 stack trace:
  reset_page_owner include/linux/page_owner.h:25 [inline]
  free_pages_prepare mm/page_alloc.c:1406 [inline]
  __free_frozen_pages+0xfe1/0x1170 mm/page_alloc.c:2943
  discard_slab mm/slub.c:3346 [inline]
  __put_partials+0x149/0x170 mm/slub.c:3886
  __slab_free+0x2af/0x330 mm/slub.c:5952
  qlink_free mm/kasan/quarantine.c:163 [inline]
  qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
  kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
  __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
  kasan_slab_alloc include/linux/kasan.h:253 [inline]
  slab_post_alloc_hook mm/slub.c:4953 [inline]
  slab_alloc_node mm/slub.c:5263 [inline]
  kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270
  getname_flags+0xb8/0x540 fs/namei.c:146
  getname include/linux/fs.h:2498 [inline]
  do_sys_openat2+0xbc/0x200 fs/open.c:1426
  do_sys_open fs/open.c:1436 [inline]
  __do_sys_openat fs/open.c:1452 [inline]
  __se_sys_openat fs/open.c:1447 [inline]
  __x64_sys_openat+0x138/0x170 fs/open.c:1447
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94

Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister")
Fixes: 78df76a065ae ("ipv4: take rt_uncached_lock only if needed")
Reported-by: syzbot+179fc225724092b8b2b2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6964cdf2.050a0220.eaf7.009d.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Martin KaFai Lau <martin.lau@kernel.org>
---
 net/core/dst.c   | 1 +
 net/ipv4/route.c | 4 ++--
 net/ipv6/route.c | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/core/dst.c b/net/core/dst.c
index e9d35f49c9e7800d7397b643c70931dd516a6265..1dae26c51ebec0bd4fc088284ce7165606d5eaf6 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -68,6 +68,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
 	dst->lwtstate = NULL;
 	rcuref_init(&dst->__rcuref, 1);
 	INIT_LIST_HEAD(&dst->rt_uncached);
+	dst->rt_uncached_list = NULL;
 	dst->__use = 0;
 	dst->lastuse = jiffies;
 	dst->flags = flags;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index b549d6a573073b3319fef2f4b76d49bf5ed7a6d7..11d990703d31a9cfa48646b298cd149025c72123 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1537,9 +1537,9 @@ void rt_add_uncached_list(struct rtable *rt)
 
 void rt_del_uncached_list(struct rtable *rt)
 {
-	if (!list_empty(&rt->dst.rt_uncached)) {
-		struct uncached_list *ul = rt->dst.rt_uncached_list;
+	struct uncached_list *ul = rt->dst.rt_uncached_list;
 
+	if (ul) {
 		spin_lock_bh(&ul->lock);
 		list_del_init(&rt->dst.rt_uncached);
 		spin_unlock_bh(&ul->lock);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a3e051dc66ee07c5bc22ba94388097b72d8270b6..e3a260a5564ba84fd4a4f9c57670c1fff7dc28ed 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -148,9 +148,9 @@ void rt6_uncached_list_add(struct rt6_info *rt)
 
 void rt6_uncached_list_del(struct rt6_info *rt)
 {
-	if (!list_empty(&rt->dst.rt_uncached)) {
-		struct uncached_list *ul = rt->dst.rt_uncached_list;
+	struct uncached_list *ul = rt->dst.rt_uncached_list;
 
+	if (ul) {
 		spin_lock_bh(&ul->lock);
 		list_del_init(&rt->dst.rt_uncached);
 		spin_unlock_bh(&ul->lock);
-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[David Ahern]

On 1/12/26 3:38 AM, Eric Dumazet wrote:
> syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> in an interesting way [1]
> 
> Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> list->prev, while the prior write on list->next went well.
> 
> static inline void INIT_LIST_HEAD(struct list_head *list)
> {
> 	WRITE_ONCE(list->next, list); // This went well
> 	WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> }
> 
> Issue here is that rt6_uncached_list_del() did not attempt to lock
> ul->lock, as list_empty(&rt->dst.rt_uncached) returned
> true because the WRITE_ONCE(list->next, list) happened on the other CPU.
> 
> We might use list_del_init_careful() and list_empty_careful(),
> or make sure rt6_uncached_list_del() always grabs the spinlock
> whenever rt->dst.rt_uncached_list has been set.
> 
> A similar fix is neeed for IPv4.
> 
> [1]
> 
>  BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD include/linux/list.h:46 [inline]
>  BUG: KASAN: slab-use-after-free in list_del_init include/linux/list.h:296 [inline]
>  BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline]
>  BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020
> Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450
> 
> CPU: 0 UID: 0 PID: 3450 Comm: kworker/u8:14 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)}
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> Workqueue: netns cleanup_net
> Call Trace:
>  <TASK>
>   dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>   print_address_description mm/kasan/report.c:378 [inline]
>   print_report+0xca/0x240 mm/kasan/report.c:482
>   kasan_report+0x118/0x150 mm/kasan/report.c:595
>   INIT_LIST_HEAD include/linux/list.h:46 [inline]
>   list_del_init include/linux/list.h:296 [inline]
>   rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline]
>   rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020
>   addrconf_ifdown+0x143/0x18a0 net/ipv6/addrconf.c:3853
>  addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
>   notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>   call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
>   call_netdevice_notifiers net/core/dev.c:2282 [inline]
>   netif_close_many+0x29c/0x410 net/core/dev.c:1785
>   unregister_netdevice_many_notify+0xb50/0x2330 net/core/dev.c:12353
>   ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
>   ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:248
>   cleanup_net+0x4de/0x7b0 net/core/net_namespace.c:696
>   process_one_work kernel/workqueue.c:3257 [inline]
>   process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
>  </TASK>
> 
> Allocated by task 803:
>   kasan_save_stack mm/kasan/common.c:57 [inline]
>   kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
>   unpoison_slab_object mm/kasan/common.c:340 [inline]
>   __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
>   kasan_slab_alloc include/linux/kasan.h:253 [inline]
>   slab_post_alloc_hook mm/slub.c:4953 [inline]
>   slab_alloc_node mm/slub.c:5263 [inline]
>   kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270
>   dst_alloc+0x105/0x170 net/core/dst.c:89
>   ip6_dst_alloc net/ipv6/route.c:342 [inline]
>   icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333
>   mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844
>   mld_send_cr net/ipv6/mcast.c:2154 [inline]
>   mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
>   process_one_work kernel/workqueue.c:3257 [inline]
>   process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> 
> Freed by task 20:
>   kasan_save_stack mm/kasan/common.c:57 [inline]
>   kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
>   kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
>   poison_slab_object mm/kasan/common.c:253 [inline]
>   __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
>   kasan_slab_free include/linux/kasan.h:235 [inline]
>   slab_free_hook mm/slub.c:2540 [inline]
>   slab_free mm/slub.c:6670 [inline]
>   kmem_cache_free+0x18f/0x8d0 mm/slub.c:6781
>   dst_destroy+0x235/0x350 net/core/dst.c:121
>   rcu_do_batch kernel/rcu/tree.c:2605 [inline]
>   rcu_core kernel/rcu/tree.c:2857 [inline]
>   rcu_cpu_kthread+0xba5/0x1af0 kernel/rcu/tree.c:2945
>   smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> 
> Last potentially related work creation:
>   kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
>   kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
>   __call_rcu_common kernel/rcu/tree.c:3119 [inline]
>   call_rcu+0xee/0x890 kernel/rcu/tree.c:3239
>   refdst_drop include/net/dst.h:266 [inline]
>   skb_dst_drop include/net/dst.h:278 [inline]
>   skb_release_head_state+0x71/0x360 net/core/skbuff.c:1156
>   skb_release_all net/core/skbuff.c:1180 [inline]
>   __kfree_skb net/core/skbuff.c:1196 [inline]
>   sk_skb_reason_drop+0xe9/0x170 net/core/skbuff.c:1234
>   kfree_skb_reason include/linux/skbuff.h:1322 [inline]
>   tcf_kfree_skb_list include/net/sch_generic.h:1127 [inline]
>   __dev_xmit_skb net/core/dev.c:4260 [inline]
>   __dev_queue_xmit+0x26aa/0x3210 net/core/dev.c:4785
>   NF_HOOK_COND include/linux/netfilter.h:307 [inline]
>   ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
>   NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
>   mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
>   mld_send_cr net/ipv6/mcast.c:2154 [inline]
>   mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
>   process_one_work kernel/workqueue.c:3257 [inline]
>   process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> 
> The buggy address belongs to the object at ffff8880294cfa00
>  which belongs to the cache ip6_dst_cache of size 232
> The buggy address is located 120 bytes inside of
>  freed 232-byte region [ffff8880294cfa00, ffff8880294cfae8)
> 
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294cf
> memcg:ffff88803536b781
> flags: 0x80000000000000(node=0|zone=1)
> page_type: f5(slab)
> raw: 0080000000000000 ffff88802ff1c8c0 ffffea0000bf2bc0 dead000000000006
> raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88803536b781
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9, tgid 9 (kworker/0:0), ts 91119585830, free_ts 91088628818
>   set_page_owner include/linux/page_owner.h:32 [inline]
>   post_alloc_hook+0x234/0x290 mm/page_alloc.c:1857
>   prep_new_page mm/page_alloc.c:1865 [inline]
>   get_page_from_freelist+0x28c0/0x2960 mm/page_alloc.c:3915
>   __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210
>   alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486
>   alloc_slab_page mm/slub.c:3075 [inline]
>   allocate_slab+0x86/0x3b0 mm/slub.c:3248
>   new_slab mm/slub.c:3302 [inline]
>   ___slab_alloc+0xb10/0x13e0 mm/slub.c:4656
>   __slab_alloc+0xc6/0x1f0 mm/slub.c:4779
>   __slab_alloc_node mm/slub.c:4855 [inline]
>   slab_alloc_node mm/slub.c:5251 [inline]
>   kmem_cache_alloc_noprof+0x101/0x6c0 mm/slub.c:5270
>   dst_alloc+0x105/0x170 net/core/dst.c:89
>   ip6_dst_alloc net/ipv6/route.c:342 [inline]
>   icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333
>   mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844
>   mld_send_cr net/ipv6/mcast.c:2154 [inline]
>   mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
>   process_one_work kernel/workqueue.c:3257 [inline]
>   process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> page last free pid 5859 tgid 5859 stack trace:
>   reset_page_owner include/linux/page_owner.h:25 [inline]
>   free_pages_prepare mm/page_alloc.c:1406 [inline]
>   __free_frozen_pages+0xfe1/0x1170 mm/page_alloc.c:2943
>   discard_slab mm/slub.c:3346 [inline]
>   __put_partials+0x149/0x170 mm/slub.c:3886
>   __slab_free+0x2af/0x330 mm/slub.c:5952
>   qlink_free mm/kasan/quarantine.c:163 [inline]
>   qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
>   kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
>   __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
>   kasan_slab_alloc include/linux/kasan.h:253 [inline]
>   slab_post_alloc_hook mm/slub.c:4953 [inline]
>   slab_alloc_node mm/slub.c:5263 [inline]
>   kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270
>   getname_flags+0xb8/0x540 fs/namei.c:146
>   getname include/linux/fs.h:2498 [inline]
>   do_sys_openat2+0xbc/0x200 fs/open.c:1426
>   do_sys_open fs/open.c:1436 [inline]
>   __do_sys_openat fs/open.c:1452 [inline]
>   __se_sys_openat fs/open.c:1447 [inline]
>   __x64_sys_openat+0x138/0x170 fs/open.c:1447
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
> 
> Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister")
> Fixes: 78df76a065ae ("ipv4: take rt_uncached_lock only if needed")
> Reported-by: syzbot+179fc225724092b8b2b2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6964cdf2.050a0220.eaf7.009d.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Martin KaFai Lau <martin.lau@kernel.org>
> ---
>  net/core/dst.c   | 1 +
>  net/ipv4/route.c | 4 ++--
>  net/ipv6/route.c | 4 ++--
>  3 files changed, 5 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 12 Jan 2026 10:38:25 +0000 you wrote:
> syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> in an interesting way [1]
> 
> Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> list->prev, while the prior write on list->next went well.
> 
> static inline void INIT_LIST_HEAD(struct list_head *list)
> {
> 	WRITE_ONCE(list->next, list); // This went well
> 	WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> }
> 
> [...]

Here is the summary with links:
  - [net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
    https://git.kernel.org/netdev/net/c/9a6f0c4d5796

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[Hillf Danton]

On Mon, 12 Jan 2026 10:38:25 +0000 Eric Dumazet wrote:
> syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> in an interesting way [1]
> 
> Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> list->prev, while the prior write on list->next went well.
> 
> static inline void INIT_LIST_HEAD(struct list_head *list)
> {
> 	WRITE_ONCE(list->next, list); // This went well
> 	WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> }
> 
> Issue here is that rt6_uncached_list_del() did not attempt to lock
> ul->lock, as list_empty(&rt->dst.rt_uncached) returned
> true because the WRITE_ONCE(list->next, list) happened on the other CPU.
> 
> We might use list_del_init_careful() and list_empty_careful(),
> or make sure rt6_uncached_list_del() always grabs the spinlock
> whenever rt->dst.rt_uncached_list has been set.
> 
> A similar fix is neeed for IPv4.
> 
FYI list corruption in dst_destroy() [1] happened after this fix.


[1] Subject: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback
https://lore.kernel.org/lkml/699d155f.050a0220.247d23.0377.GAE@google.com/

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[Eric Dumazet]

On Tue, Feb 24, 2026 at 12:41 PM Hillf Danton <hdanton@sina.com> wrote:
>
> On Mon, 12 Jan 2026 10:38:25 +0000 Eric Dumazet wrote:
> > syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> > in an interesting way [1]
> >
> > Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> > list->prev, while the prior write on list->next went well.
> >
> > static inline void INIT_LIST_HEAD(struct list_head *list)
> > {
> >       WRITE_ONCE(list->next, list); // This went well
> >       WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> > }
> >
> > Issue here is that rt6_uncached_list_del() did not attempt to lock
> > ul->lock, as list_empty(&rt->dst.rt_uncached) returned
> > true because the WRITE_ONCE(list->next, list) happened on the other CPU.
> >
> > We might use list_del_init_careful() and list_empty_careful(),
> > or make sure rt6_uncached_list_del() always grabs the spinlock
> > whenever rt->dst.rt_uncached_list has been set.
> >
> > A similar fix is neeed for IPv4.
> >
> FYI list corruption in dst_destroy() [1] happened after this fix.
>
>
> [1] Subject: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback
> https://lore.kernel.org/lkml/699d155f.050a0220.247d23.0377.GAE@google.com/

Seems unrelated.

Are you seeing anything wrong with my patch ?

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[Christian A. Ehrhardt]

Hi,

On Tue, Feb 24, 2026 at 12:58:25PM +0100, Eric Dumazet wrote:
> On Tue, Feb 24, 2026 at 12:41 PM Hillf Danton <hdanton@sina.com> wrote:
> >
> > On Mon, 12 Jan 2026 10:38:25 +0000 Eric Dumazet wrote:
> > > syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> > > in an interesting way [1]
> > >
> > > Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> > > list->prev, while the prior write on list->next went well.
> > >
> > > static inline void INIT_LIST_HEAD(struct list_head *list)
> > > {
> > >       WRITE_ONCE(list->next, list); // This went well
> > >       WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> > > }
> > >
> > > Issue here is that rt6_uncached_list_del() did not attempt to lock
> > > ul->lock, as list_empty(&rt->dst.rt_uncached) returned
> > > true because the WRITE_ONCE(list->next, list) happened on the other CPU.
> > >
> > > We might use list_del_init_careful() and list_empty_careful(),
> > > or make sure rt6_uncached_list_del() always grabs the spinlock
> > > whenever rt->dst.rt_uncached_list has been set.
> > >
> > > A similar fix is neeed for IPv4.
> > >
> > FYI list corruption in dst_destroy() [1] happened after this fix.
> >
> >
> > [1] Subject: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback
> > https://lore.kernel.org/lkml/699d155f.050a0220.247d23.0377.GAE@google.com/
> 
> Seems unrelated.
> 
> Are you seeing anything wrong with my patch ?

I'm certainly not an expert on this code and I might well be wrong
but it seems that with your patch your are racing against a list
delete in rt6_uncached_list_flush_dev which removes the item from
the list but does not reset dst.rt_uncached_list.

So I think you want to keep the list_empty() check but do it
under the lock?

Best regards,
Christian

Re: [PATCH net] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

[Eric Dumazet]

On Wed, Feb 25, 2026 at 8:33 AM Christian A. Ehrhardt <lk@c--e.de> wrote:
>
>
> Hi,
>
> On Tue, Feb 24, 2026 at 12:58:25PM +0100, Eric Dumazet wrote:
> > On Tue, Feb 24, 2026 at 12:41 PM Hillf Danton <hdanton@sina.com> wrote:
> > >
> > > On Mon, 12 Jan 2026 10:38:25 +0000 Eric Dumazet wrote:
> > > > syzbot was able to crash the kernel in rt6_uncached_list_flush_dev()
> > > > in an interesting way [1]
> > > >
> > > > Crash happens in list_del_init()/INIT_LIST_HEAD() while writing
> > > > list->prev, while the prior write on list->next went well.
> > > >
> > > > static inline void INIT_LIST_HEAD(struct list_head *list)
> > > > {
> > > >       WRITE_ONCE(list->next, list); // This went well
> > > >       WRITE_ONCE(list->prev, list); // Crash, @list has been freed.
> > > > }
> > > >
> > > > Issue here is that rt6_uncached_list_del() did not attempt to lock
> > > > ul->lock, as list_empty(&rt->dst.rt_uncached) returned
> > > > true because the WRITE_ONCE(list->next, list) happened on the other CPU.
> > > >
> > > > We might use list_del_init_careful() and list_empty_careful(),
> > > > or make sure rt6_uncached_list_del() always grabs the spinlock
> > > > whenever rt->dst.rt_uncached_list has been set.
> > > >
> > > > A similar fix is neeed for IPv4.
> > > >
> > > FYI list corruption in dst_destroy() [1] happened after this fix.
> > >
> > >
> > > [1] Subject: Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback
> > > https://lore.kernel.org/lkml/699d155f.050a0220.247d23.0377.GAE@google.com/
> >
> > Seems unrelated.
> >
> > Are you seeing anything wrong with my patch ?
>
> I'm certainly not an expert on this code and I might well be wrong
> but it seems that with your patch your are racing against a list
> delete in rt6_uncached_list_flush_dev which removes the item from
> the list but does not reset dst.rt_uncached_list.

Both rt_del_uncached_list() and rt6_uncached_list_flush_dev() use
list_del_init()
with the spinlock held. No race is possible.

>
> So I think you want to keep the list_empty() check but do it
> under the lock?

A second list_del_init() is a NOP, so adding a list_empty() would only
add extra code
for a condition which is already handled.

>
> Best regards,
> Christian

Thanks.