From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F17962AE8D for ; Sun, 16 Aug 2026 11:26:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786879622; cv=none; b=KBxa2rHMCRnhtHmJfKInwB60p1U78ICxozI8Gmqjue1hdBAl2gHdf1jKwljPPRnPeHKYy1KpaMBecpFD8yCR6wh5fIKvYcRkXtliMEht9U5hJqp8SWSQXb40jjUsy+MFeKnLUxJRBfui3IJNyqMUgwqusmm5zoksTWO0LGjEVjs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786879622; c=relaxed/simple; bh=GJQxoOEI82kYZgbkA2M3DWUOfXbIzfMVlcW5bXPgOoE=; h=From:To:Cc:Subject:Message-ID:In-Reply-To:References:MIME-Version: Content-Type:Date; b=NV4UqGLjHGLOBS61BvmXlUxUz87+kqUR/VQlIz2Pg/gAK9PuYI4eIwO1vFxSngZjE2BW5u9HYmS4GsbFUcx01hUa99CFjRc91bKmiMkpV+Eo4Dfer3JP3rtPS2FZi+teI3S1vXRJrrwQX2fc2nLIeAgdFocg/ZknKEyH8U5zZoo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=R32MyC6b; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=DS1WzV3u; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="R32MyC6b"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="DS1WzV3u" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786879618; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RG/0CkmnfI4ubU5H6lTIDt7bAjkJ/SgtQ01dx0rQ568=; b=R32MyC6b0Hqg3eWbPJ5W9jcJqUAcHygFTdN4ZV9eN1asvgABdcCOQrgsElDbh7BpeWodOO 48UodlCZEEUxbPQK0G64lh1krSy2S9lrZtYul/4m0tHBJlXUCi++nvGtSbykADjM0l175b nZ/7yrj9Qjn/VA/XF0uh0JbiUiblkHc= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-495-AkqxoKl9MqmAAutWZ2aU5w-1; Sun, 16 Aug 2026 07:26:57 -0400 X-MC-Unique: AkqxoKl9MqmAAutWZ2aU5w-1 X-Mimecast-MFC-AGG-ID: AkqxoKl9MqmAAutWZ2aU5w_1786879616 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-496b61bd846so16792005e9.2 for ; Sun, 16 Aug 2026 04:26:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1786879616; x=1787484416; darn=vger.kernel.org; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :from:to:cc:subject:date:message-id:reply-to:content-type; bh=RG/0CkmnfI4ubU5H6lTIDt7bAjkJ/SgtQ01dx0rQ568=; b=DS1WzV3uRBZy1D1eGa6oezneZuwMXWRrl2QWys0rSx7Cp9ytTJyJh4XqNVowe654P0 nNcGn1/Q0eaDcNb0YtHQ2rsQxsIsbHEpMUTHqG5KF9okne3u50cr/bQwMe0+2Yf2CcuF WParIzZtX/7HbdrHRUg03w6sT9Ufv7tTUHLN51v3P2FBqv/P0mCkh99PivwMy8Ap8f1i aNOALadMT6r4QvgNEWwBj3XYSFN2c9m6/wjAkpubs8Fc2b8OpPkntop4ZXCw4gjWGrbF DEwxNzoodlIG8sl7AF6LAjUbhFPY3QrXIdRQ+XFEiZ2VXH8knq8ls+yARsjjiWlH/Cu4 1SxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786879616; x=1787484416; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RG/0CkmnfI4ubU5H6lTIDt7bAjkJ/SgtQ01dx0rQ568=; b=rFydQD8DXRNmbvg4/uxa/r6JBOjbBsK8M+T109ydqG2dA7CXNhglCK3zK35ZlCCN2Z 9TkmLYMqnlStVne6hO5UPsPgvEfBiwEaW7CrsvSIr4togLN4J4LpnENhSxlLKe1dv87U Pl+69Twlrl9y6Rej7Uo61s4EgtGVWFqVcUGUN5obncG/tB2vbzZNcZWEd7Q2mTjxdMvq BUSTFjC3/86xBYwdazU+Rh1f4wG8PTGwJikweW989McYRqzrVcNnPku7g/WUA+UwXGBX nUxfHAZ/VAhG/fXP4fnWm6oMxyj1hgPwkDY/Vuz7noIbJ37FQCiwMXdVTZHdtd6WVmXd saPA== X-Forwarded-Encrypted: i=1; AHgh+Rojrw6Zya/f+acH5Nlf7tJhXxrpfnx9w3HATZFMGMOmZu3o0Y13kislRSm4ROnLG9fVoXdflhkGs3xTRPk=@vger.kernel.org X-Gm-Message-State: AOJu0YxCEAGuN8hAFxZgOzJ+e1CwZ3/v+U5rt4NGMUkjcEa5l6VDUw0d /llD4CIl7W4Ga++LFuX/0bdviH17HXwBnhkkvE113rl2+Z84kajAb5rhwwl0H3hI6LI8j7Izj+M x4omGg+wV/22S/PEI5EkU2JQ9tEkSWgT+/MuypTPjWn8bVVb9ykpkWV/FXAj1Y3SYgg== X-Gm-Gg: AR+sD102IjkW+YO2B3Csz2ib+3b1R9AoHNQTeghwNPaUJrPlhjd5inTVHE+7MVh1BGK lBkCJ2eBtQ6BNZ9Oukr7rwwt+LIZVywBvEbA+k7a76SCPKxshgqlRWpvcOh3q46JMr93Le56p4G MAZvtmtTGEyhBPZPW2RyaOe1hQYpbhuSD9WePhNO3feIw3UFOdxwZkW2vnVHTKYFw2C+2kqb1tE Jh6wxIV5dQhhvjlug5GbYxwkHE9jrFwAb3GEERaaGnfUUFJ24u6DULK+UiC2oQSHDSDw7VvC61d HsBEDIQ1HV8RLRTV7hCjl/f3quH2GpoDWsigER10RYpKXwUHbUlr/hLTu1k5g7+Kpp3wuxg/WmU 89EcC5HWJrq8+8hhwtvDngdI/GvR6 X-Received: by 2002:a05:600c:6986:b0:499:79ba:ed92 with SMTP id 5b1f17b1804b1-49988c5efe7mr311028145e9.13.1786879616273; Sun, 16 Aug 2026 04:26:56 -0700 (PDT) X-Received: by 2002:a05:600c:6986:b0:499:79ba:ed92 with SMTP id 5b1f17b1804b1-49988c5efe7mr311027455e9.13.1786879615824; Sun, 16 Aug 2026 04:26:55 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499960fef95sm47627815e9.1.2026.08.16.04.26.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Aug 2026 04:26:55 -0700 (PDT) From: Stefano Brivio To: Yuyang Huang Cc: "David S. Miller" , David Ahern , Eric Dumazet , Ido Schimmel , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH net] ipv6: use RCU iterator to dump route exceptions Message-ID: <20260816132653.1fa1b16f@elisabeth> In-Reply-To: <20260815084651.69477-1-sigefriedhyy@gmail.com> References: <20260815084651.69477-1-sigefriedhyy@gmail.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Date: Sun, 16 Aug 2026 13:26:54 +0200 (CEST) On Sat, 15 Aug 2026 17:46:51 +0900 Yuyang Huang wrote: > rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over > RCU-protected exception lists. The caller holds rcu_read_lock(), but does > not hold rt6_exception_lock, so rt6_insert_exception() can concurrently > add an entry with hlist_add_head_rcu(). Ah, right, I didn't consider that, thanks for fixing this. > > KCSAN reports this race (irrelevant details omitted): > > ================================================================== > BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions > > write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5: > rt6_insert_exception+0x3bb/0x760 > __ip6_rt_update_pmtu+0x4fe/0x750 > ip6_sk_update_pmtu+0x19a/0x3b0 > udpv6_err+0x3ff/0x800 > icmpv6_notify+0x1e1/0x440 > icmpv6_rcv+0x8c0/0xab0 > ip6_protocol_deliver_rcu+0x616/0x840 > ip6_input_finish+0xb9/0x160 > ... > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14: > rt6_nh_dump_exceptions+0xb3/0x260 > rt6_dump_route+0x53e/0x5f0 > fib6_dump_node+0x6d/0xf0 > fib6_walk_continue+0x290/0x2d0 > fib6_dump_table+0x28d/0x360 > inet6_dump_fib+0x37d/0x620 > rtnl_dumpit+0x7b/0xd0 > netlink_dump+0x3ae/0x7e0 > ... > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > 4 locks held by dumper/549: > ... > #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620 > #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360 > #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0 > > value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100 > > Reported by Kernel Concurrency Sanitizer on: > CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted > 7.2.0-rc7-virtme #38 PREEMPT(lazy) > ... > > Use hlist_for_each_entry_rcu() to safely iterate over the exception list. > > Fixes: 1e47b4837f3b ("ipv6: Dump route exceptions if requested") > Cc: stable@vger.kernel.org > Signed-off-by: Yuyang Huang > --- > net/ipv6/route.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index 16dfac54a259..526535387512 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -6046,7 +6046,7 @@ static int rt6_nh_dump_exceptions(struct fib6_nh *nh, void *arg) > return 0; > > for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) { > - hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) { > + hlist_for_each_entry_rcu(rt6_ex, &bucket->chain, hlist) { > if (w->skip) { > w->skip--; > continue; Reviewed-by: Stefano Brivio -- Stefano