Linux kernel -stable discussions
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15.y 1/2] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR
Date: Tue,  8 Sep 2026 20:25:06 -0400	[thread overview]
Message-ID: <20260909002507.725158-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090351-sagging-obliged-3e7b@gregkh>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 3bdfb04f13ebdd4ae50fc5dc595663874781e48c ]

IPv4 reassembly unit can decide to drop frags based on
/proc/sys/net/ipv4/ipfrag_max_dist sysctl.

Add a specific drop reason to track this specific
and weird case.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

[ Backport to 5.15: the original IPv4 drop-reason change cannot be
represented because this tree predates include/net/dropreason.h and the
reason-aware fragment purge API. Add only SKB_DROP_REASON_IPV6DISABLED to
the older enum and trace table, and align the IPv6 routing-header code so
the dependent fix applies cleanly. ]

[ sashal: Reduced backport -- upstream 3bdfb04f13ebd touches 2 file(s), this
  backport carries 3. Not backported here:
  include/net/dropreason.h
  net/ipv4/ip_fragment.c
  This note is generated from the file lists only; see the resolution record
  for the reasoning. ]

Stable-dep-of: f826df95332c ("ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/skbuff.h     |  1 +
 include/trace/events/skb.h |  1 +
 net/ipv6/exthdrs.c         | 12 +++---------
 3 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 24ceeab1b509f..af4924ceafe61 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -337,6 +337,7 @@ enum skb_drop_reason {
 						  * is multicast, but L3 is
 						  * unicast.
 						  */
+	SKB_DROP_REASON_IPV6DISABLED,	/* IPv6 is disabled on the device */
 	SKB_DROP_REASON_MAX,
 };
 
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 485a1d3034a4b..33bebe0c7677e 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -23,6 +23,7 @@
 	EM(SKB_DROP_REASON_IP_RPFILTER, IP_RPFILTER)		\
 	EM(SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST,		\
 	   UNICAST_IN_L2_MULTICAST)				\
+	EM(SKB_DROP_REASON_IPV6DISABLED, IPV6DISABLED)		\
 	EMe(SKB_DROP_REASON_MAX, MAX)
 
 #undef EM
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 3c6de4ccbf53b..3bfe826c3134f 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -495,7 +495,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 	struct net *net = dev_net(skb->dev);
 	struct inet6_dev *idev;
 	struct ipv6hdr *oldhdr;
-	struct in6_addr addr;
 	unsigned int chdr_len;
 	unsigned char *buf;
 	int accept_rpl_seg;
@@ -505,10 +504,8 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 
 	idev = __in6_dev_get(skb->dev);
 
-	accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
-	if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
-		accept_rpl_seg = idev->cnf.rpl_seg_enabled;
-
+	accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
+			     READ_ONCE(idev->cnf.rpl_seg_enabled));
 	if (!accept_rpl_seg) {
 		kfree_skb(skb);
 		return -1;
@@ -607,9 +604,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 		return -1;
 	}
 
-	addr = ipv6_hdr(skb)->daddr;
-	ipv6_hdr(skb)->daddr = ohdr->rpl_segaddr[i];
-	ohdr->rpl_segaddr[i] = addr;
+	swap(ipv6_hdr(skb)->daddr, ohdr->rpl_segaddr[i]);
 
 	ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
 
@@ -690,7 +685,6 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
 	struct net *net = dev_net(skb->dev);
 	int accept_source_route;
 
-	idev = __in6_dev_get(skb->dev);
 	accept_source_route = READ_ONCE(net->ipv6.devconf_all->accept_source_route);
 
 	if (idev)
-- 
2.53.0


  parent reply	other threads:[~2026-09-09  0:25 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03 14:00 FAILED: patch "[PATCH] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()" failed to apply to 5.15-stable tree gregkh
2026-09-08 22:37 ` [PATCH 5.15.y 1/3] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR Sasha Levin
2026-09-08 22:37   ` [PATCH 5.15.y 2/3] ipv6: icmp6: add drop reason support to ndisc_rcv() Sasha Levin
2026-09-08 22:37   ` [PATCH 5.15.y 3/3] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Sasha Levin
2026-09-09  0:25 ` Sasha Levin [this message]
2026-09-09  0:25   ` [PATCH 5.15.y 2/2] " Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260909002507.725158-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox