[PATCH net v3] vrf: Drop existing dst reference in vrf_ip6_input_dst

[PATCH net v3] vrf: Drop existing dst reference in vrf_ip6_input_dst

[Stanislav Fomichev]

Commit ff3fbcdd4724 ("selftests: tc: Add generic erspan_opts matching support
for tc-flower") started triggering the following kmemleak warning:

unreferenced object 0xffff888015fb0e00 (size 512):
  comm "softirq", pid 0, jiffies 4294679065
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 40 d2 85 9e ff ff ff ff  ........@.......
    41 69 59 9d ff ff ff ff 00 00 00 00 00 00 00 00  AiY.............
  backtrace (crc 30b71e8b):
    __kmalloc_noprof+0x359/0x460
    metadata_dst_alloc+0x28/0x490
    erspan_rcv+0x4f1/0x1160 [ip_gre]
    gre_rcv+0x217/0x240 [ip_gre]
    gre_rcv+0x1b8/0x400 [gre]
    ip_protocol_deliver_rcu+0x31d/0x3a0
    ip_local_deliver_finish+0x37d/0x620
    ip_local_deliver+0x174/0x460
    ip_rcv+0x52b/0x6b0
    __netif_receive_skb_one_core+0x149/0x1a0
    process_backlog+0x3c8/0x1390
    __napi_poll.constprop.0+0xa1/0x390
    net_rx_action+0x59b/0xe00
    handle_softirqs+0x22b/0x630
    do_softirq+0xb1/0xf0
    __local_bh_enable_ip+0x115/0x150

vrf_ip6_input_dst unconditionally sets skb dst entry, add a call to
skb_dst_drop to drop any existing entry.

Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Fixes: 9ff74384600a ("net: vrf: Handle ipv6 multicast and link-local addresses")
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
--
v3: fix commit id
v2: repost without the skb_dst_check
---
 drivers/net/vrf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 9a4beea6ee0c..3ccd649913b5 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1302,6 +1302,8 @@ static void vrf_ip6_input_dst(struct sk_buff *skb, struct net_device *vrf_dev,
 	struct net *net = dev_net(vrf_dev);
 	struct rt6_info *rt6;
 
+	skb_dst_drop(skb);
+
 	rt6 = vrf_ip6_route_lookup(net, vrf_dev, &fl6, ifindex, skb,
 				   RT6_LOOKUP_F_HAS_SADDR | RT6_LOOKUP_F_IFACE);
 	if (unlikely(!rt6))
-- 
2.50.1

Re: [PATCH net v3] vrf: Drop existing dst reference in vrf_ip6_input_dst

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 25 Jul 2025 09:00:43 -0700 you wrote:
> Commit ff3fbcdd4724 ("selftests: tc: Add generic erspan_opts matching support
> for tc-flower") started triggering the following kmemleak warning:
> 
> unreferenced object 0xffff888015fb0e00 (size 512):
>   comm "softirq", pid 0, jiffies 4294679065
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 40 d2 85 9e ff ff ff ff  ........@.......
>     41 69 59 9d ff ff ff ff 00 00 00 00 00 00 00 00  AiY.............
>   backtrace (crc 30b71e8b):
>     __kmalloc_noprof+0x359/0x460
>     metadata_dst_alloc+0x28/0x490
>     erspan_rcv+0x4f1/0x1160 [ip_gre]
>     gre_rcv+0x217/0x240 [ip_gre]
>     gre_rcv+0x1b8/0x400 [gre]
>     ip_protocol_deliver_rcu+0x31d/0x3a0
>     ip_local_deliver_finish+0x37d/0x620
>     ip_local_deliver+0x174/0x460
>     ip_rcv+0x52b/0x6b0
>     __netif_receive_skb_one_core+0x149/0x1a0
>     process_backlog+0x3c8/0x1390
>     __napi_poll.constprop.0+0xa1/0x390
>     net_rx_action+0x59b/0xe00
>     handle_softirqs+0x22b/0x630
>     do_softirq+0xb1/0xf0
>     __local_bh_enable_ip+0x115/0x150
> 
> [...]

Here is the summary with links:
  - [net,v3] vrf: Drop existing dst reference in vrf_ip6_input_dst
    https://git.kernel.org/netdev/net/c/f388f807eca1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html