github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-30 14:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
261e8a37ec
linux/include
History
Kuniyuki Iwashima be31fe6333 ipv6: Fix dst leak for uncached routes. 
ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check()
detect an uncached route by list_empty(&rt->dst.rt_uncached),
which replaced the static DST_NOCACHE flag check in commit
a4c2fd7f78 ("net: remove DST_NOCACHE flag").

When a device is unregistered, rt6_uncached_list_flush_dev()
unlinks uncached routes tied to the device from rt6_uncached_list.

Previously, they were moved to another list with list_move()
(__list_del_entry() + list_add()), and since commit 98aa546af5
("inet: remove (struct uncached_list)->quarantine"), the routes
are just unlinked with list_del_init().

If list_del_init() runs concurrently, list_empty() evaluates to
true; ip6_route_output_flags() calls dst_hold_safe() incorrectly
and ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus
dev tied via rt->from as well.

The same race is partially fixed by commit 9a6f0c4d57 ("dst:
fix races in rt6_uncached_list_del() and rt_del_uncached_list()").

Let's check rt6->dst.rt_uncached_list instead.

Note that IPv4 does not have the same issue.

Fixes: 98aa546af5 ("inet: remove (struct uncached_list)->quarantine")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260920191558.2990636-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21 18:12:42 -07:00
..
acpi ACPI: bus: Drop two fields from struct acpi_device_pnp 2026-09-01 21:45:50 +02:00
asm-generic kho: make boot time huge page allocation work nicely with KHO 2026-08-23 09:17:38 -07:00
clocksource hyperv-next for v7.3-rc1 2026-08-26 16:47:40 -07:00
crypto This update includes the following changes: 2026-08-19 17:25:42 -07:00
cxl
drm Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
dt-bindings sound fixes for 7.3-rc1 2026-08-28 10:01:02 -07:00
hyperv
keys tpm: Initial step to reorganize TPM public headers 2026-08-25 18:13:35 +03:00
kunit
kvm KVM/arm64 changes for 7.3 2026-08-24 12:42:07 -04:00
linux vlan: require the MAC header to be present in __vlan_insert_inner_tag() 2026-09-19 15:47:15 -07:00
math-emu
media media: hevc: add bounded tile-count helpers 2026-09-07 09:01:05 +02:00
memory
misc
net ipv6: Fix dst leak for uncached routes. 2026-09-21 18:12:42 -07:00
pcmcia
ras
rdma RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency 2026-09-01 10:03:08 -04:00
rv mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
scsi SCSI updates for 7.3 2026-08-29 11:55:36 -07:00
soc Mostly the usual clk driver updates and new SoC additions plus non-critical 2026-08-26 11:14:30 -07:00
sound ASoC: sdw_utils: cs_amp: Delete bogus and incorrect capture channel fixup 2026-09-14 00:37:41 +01:00
target
trace dma-mapping fixes for Linux 7.3 2026-09-17 08:03:37 -07:00
uapi RDMA v7.3 first rc pull 2026-09-14 09:58:12 -07:00
ufs
vdso
video fbdev: maxine: fix 64-bit build error 2026-08-20 23:45:07 +02:00
xen
Kbuild