From 4eb2e2f358fcc055641879a56885d428e47878ed Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Thu, 1 Oct 2026 20:47:16 +0000 Subject: [PATCH] xfrm: Check netif_is_alive() in xfrm_bundle_create() and xfrm_create_dummy_bundle(). struct dst_entry passed to xfrm_bundle_create() and xfrm_create_dummy_bundle() could outlive synchronize_net() in unregister_netdevice_many_notify(). For example, ip_route_output_flow() calls __ip_route_output_key() to fetch a dst under RCU, but calls xfrm_lookup_route() outside of that RCU critical section. Thus, xfrm_fill_dst() could add a new uncached route after the first NETDEV_UNREGISTER notification and rely on the rebroadcast in netdev_wait_allrefs_any(). The following patches will move the uncached route flush for dying netdev from the NETDEV_UNREGISTER handler to netdev_run_todo(), where the rebroadcast is also skipped due to dev->dismantle, making such late additions problematic. Let's check netif_is_alive() after fetching dst_dev_rcu(dst) under RCU. This ensures that xfrm either finishes adding the uncached route before synchronize_net() or fails with -ENODEV. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Tested-by: Chris J Arges Link: https://patch.msgid.link/20261001204752.2572265-5-kuniyu@google.com Signed-off-by: Jakub Kicinski --- net/xfrm/xfrm_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 513c9f228334..9ea60c7717ff 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -2772,7 +2772,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, err = -ENODEV; rcu_read_lock(); dev = dst_dev_rcu(dst); - if (!dev) { + if (!dev || !netif_is_alive(dev)) { rcu_read_unlock(); goto free_dst; } @@ -3066,7 +3066,7 @@ static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net, err = -ENODEV; rcu_read_lock(); dev = dst_dev_rcu(dst); - if (!dev) { + if (!dev || !netif_is_alive(dev)) { rcu_read_unlock(); goto free_dst; }