Re: [PATCH] ipv6: icmp: use skb_dst_dev_net_rcu() for echo reply and unreach

[Ido Schimmel]

On Mon, Oct 19, 2026 at 09:22:13PM +0800, Haoran Wang wrote:
> ip6_err_gen_icmpv6_unreach() and icmpv6_echo_reply() derive the network
> namespace from the ingress device with dev_net_rcu(skb->dev).
> 
>     /* ip6_err_gen_icmpv6_unreach, net/ipv6/icmp.c:885 */
>     rt = rt6_lookup(dev_net_rcu(skb->dev), &ipv6_hdr(skb2)->saddr, ...);
> 
>     /* icmpv6_echo_reply, net/ipv6/icmp.c:923 */
>     struct net *net = dev_net_rcu(skb->dev);
> 
> Under a VRF, skb->dev is the VRF master device, so dev_net_rcu(skb->dev)
> returns the netns of the master rather than the netns the packet is
> destined to.  The route lookup for the unreach and the send policy for
> the echo reply (ratelimit, IPsec, route) then run against the wrong
> namespace.  The rt6_lookup may miss the route to the source, leaving
> skb2->dev unset, and the echo reply is emitted/routed per the ingress
> netns instead of the destination netns.
> 
> The IPv4 ICMP echo path already uses the destination netns via
> skb_dst_dev_net_rcu(skb) (net/ipv4/icmp.c:1123 and :1267), and the IPv6
> echo path still uses dev_net_rcu(skb->dev).
> 
> Use skb_dst_dev_net_rcu(skb) at both IPv6 sites so the namespace is
> taken from the skb destination, matching the IPv4 path.

I don't understand any of this. VRF master and slave are always in the
same netns. Same comment about the IPv4 patch.