Re: [PATCH net] net: protect negative destination advice with RCU

[Kuniyuki Iwashima <kuniyu@google.com>]

On Wed, 04 Nov 2026 14:17:44 +0100, Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> SO_CNX_ADVICE calls __dst_negative_advice() while holding the socket
> lock. Connected UDP sends can still invalidate or replace sk_dst_cache
> without that lock. A concurrent sk_dst_check() can drop the final
> destination reference and allow an RCU callback to destroy it while
> __dst_negative_advice() retains only a borrowed pointer. This can cause
> a use-after-free while accessing dst->ops or running the negative_advice
> callback.
> 
> The writer-side ordering fixed by commit 92f1655aa2b2 ("net: fix
> __dst_negative_advice() race") does not protect this reader from an
> independent cache replacement.
> 
> Hold an RCU read-side critical section across the lookup and callback.
> This follows the datagram release callbacks and covers IPv4, IPv6, and
> XFRM advice without changing cache-reset or reference-ownership rules.
> 
> Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>