From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15.y 1/2] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR
Date: Tue, 8 Sep 2026 20:25:06 -0400 [thread overview]
Message-ID: <20260909002507.725158-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090351-sagging-obliged-3e7b@gregkh>
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 3bdfb04f13ebdd4ae50fc5dc595663874781e48c ]
IPv4 reassembly unit can decide to drop frags based on
/proc/sys/net/ipv4/ipfrag_max_dist sysctl.
Add a specific drop reason to track this specific
and weird case.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Backport to 5.15: the original IPv4 drop-reason change cannot be
represented because this tree predates include/net/dropreason.h and the
reason-aware fragment purge API. Add only SKB_DROP_REASON_IPV6DISABLED to
the older enum and trace table, and align the IPv6 routing-header code so
the dependent fix applies cleanly. ]
[ sashal: Reduced backport -- upstream 3bdfb04f13ebd touches 2 file(s), this
backport carries 3. Not backported here:
include/net/dropreason.h
net/ipv4/ip_fragment.c
This note is generated from the file lists only; see the resolution record
for the reasoning. ]
Stable-dep-of: f826df95332c ("ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/skbuff.h | 1 +
include/trace/events/skb.h | 1 +
net/ipv6/exthdrs.c | 12 +++---------
3 files changed, 5 insertions(+), 9 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 24ceeab1b509f..af4924ceafe61 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -337,6 +337,7 @@ enum skb_drop_reason {
* is multicast, but L3 is
* unicast.
*/
+ SKB_DROP_REASON_IPV6DISABLED, /* IPv6 is disabled on the device */
SKB_DROP_REASON_MAX,
};
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 485a1d3034a4b..33bebe0c7677e 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -23,6 +23,7 @@
EM(SKB_DROP_REASON_IP_RPFILTER, IP_RPFILTER) \
EM(SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST, \
UNICAST_IN_L2_MULTICAST) \
+ EM(SKB_DROP_REASON_IPV6DISABLED, IPV6DISABLED) \
EMe(SKB_DROP_REASON_MAX, MAX)
#undef EM
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 3c6de4ccbf53b..3bfe826c3134f 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -495,7 +495,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
struct net *net = dev_net(skb->dev);
struct inet6_dev *idev;
struct ipv6hdr *oldhdr;
- struct in6_addr addr;
unsigned int chdr_len;
unsigned char *buf;
int accept_rpl_seg;
@@ -505,10 +504,8 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
idev = __in6_dev_get(skb->dev);
- accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
- if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
- accept_rpl_seg = idev->cnf.rpl_seg_enabled;
-
+ accept_rpl_seg = min(READ_ONCE(net->ipv6.devconf_all->rpl_seg_enabled),
+ READ_ONCE(idev->cnf.rpl_seg_enabled));
if (!accept_rpl_seg) {
kfree_skb(skb);
return -1;
@@ -607,9 +604,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
return -1;
}
- addr = ipv6_hdr(skb)->daddr;
- ipv6_hdr(skb)->daddr = ohdr->rpl_segaddr[i];
- ohdr->rpl_segaddr[i] = addr;
+ swap(ipv6_hdr(skb)->daddr, ohdr->rpl_segaddr[i]);
ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
@@ -690,7 +685,6 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
struct net *net = dev_net(skb->dev);
int accept_source_route;
- idev = __in6_dev_get(skb->dev);
accept_source_route = READ_ONCE(net->ipv6.devconf_all->accept_source_route);
if (idev)
--
2.53.0
next prev parent reply other threads:[~2026-09-09 0:25 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 14:00 FAILED: patch "[PATCH] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()" failed to apply to 5.15-stable tree gregkh
2026-09-08 22:37 ` [PATCH 5.15.y 1/3] net: dropreason: add SKB_DROP_REASON_FRAG_TOO_FAR Sasha Levin
2026-09-08 22:37 ` [PATCH 5.15.y 2/3] ipv6: icmp6: add drop reason support to ndisc_rcv() Sasha Levin
2026-09-08 22:37 ` [PATCH 5.15.y 3/3] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Sasha Levin
2026-09-09 0:25 ` Sasha Levin [this message]
2026-09-09 0:25 ` [PATCH 5.15.y 2/2] " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260909002507.725158-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox