Re: [PATCH net-next] net/dst: improve dst_ops refcounting with per-dst bit

[xietangxin <xietangxin@yeah.net>]

On 3/27/2026 11:51 AM, Eric Dumazet wrote:
> On Tue, Mar 24, 2026 at 8:42 PM xietangxin <xietangxin@yeah.net> wrote:
>>
> 
>> Hi Eric,
>>
>> I tested your patch with my reproduction script, but the UAF still occurs
>> with a warning in dst_entries_destroy() just before the crash.
>>
>> The reason is that for IPv6, dst_entries on the rt6_uncached_list are
>> handled by rt6_uncached_list_flush_dev() during netns destruction,
>> which bypasses dst_dev_put().
>>
>> I tested add changes like dst_dev_put() inside rt6_uncached_list_flush_dev(),
>> the UAF is gone and the dst_entries_destroy warning no longer appears.
> 
> 
> Could you share  the incremental patch you added on top of mine ?
> 
> Thanks.

Hi Eric,

Sure. Here is the incremental patch that I added on top of your patch.

---
diff --git a/include/net/dst.h b/include/net/dst.h
index 793f38452bf4..393cc84b6aa5 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -401,6 +401,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
              struct net_device *dev, int initial_obsolete,
              unsigned short flags);
 void dst_dev_put(struct dst_entry *dst);
+void dst_count_dec(struct dst_entry *dst);

 static inline void dst_confirm(struct dst_entry *dst)
 {
diff --git a/net/core/dst.c b/net/core/dst.c
index d1efd3e7c44e..b5c5e04e10c1 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -139,7 +139,7 @@ static void dst_destroy_rcu(struct rcu_head *head)
    dst_destroy(dst);
 }

-static void dst_count_dec(struct dst_entry *dst)
+void dst_count_dec(struct dst_entry *dst)
 {
    struct dst_ops *ops = READ_ONCE(dst->ops);

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 658c0f742e45..9744a8e2fdc8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -173,6 +173,7 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev)
            struct inet6_dev *rt_idev = rt->rt6i_idev;
            struct net_device *rt_dev = rt->dst.dev;
            bool handled = false;
+           struct dst_entry *dst = &rt->dst;

            if (rt_idev && rt_idev->dev == dev) {
                rt->rt6i_idev = in6_dev_get(blackhole_netdev);
@@ -181,14 +182,16 @@ static void rt6_uncached_list_flush_dev(struct net_device *dev)
            }

            if (rt_dev == dev) {
-               rt->dst.dev = blackhole_netdev;
+               dst->dev = blackhole_netdev;
+               dst_count_dec(dst);
+               WRITE_ONCE(dst->ops, dst->ops->template);
                netdev_ref_replace(rt_dev, blackhole_netdev,
-                          &rt->dst.dev_tracker,
+                          &dst->dev_tracker,
                           GFP_ATOMIC);
                handled = true;
            }
            if (handled)
-               list_del_init(&rt->dst.rt_uncached);
+               list_del_init(&dst->rt_uncached);
        }
        spin_unlock_bh(&ul->lock);
    }

-- 
Best regards,
Tangxin Xie