Re: [PATCH net] seg6: fix tun_src RCU lifetime on namespace teardown

[Andrea Mayer]

On Sun, 25 Oct 2026 22:22:22 +0000
Tristan Madani <tristmd@xxxxxxxxx> wrote:

> Found by manual code inspection while auditing RCU lifetime
> patterns in the seg6 subsystem.  The issue is theoretical --
> found by reading the source, not triggered in production.

Hi Tristan,
thanks for the info.

The pre_exit in this patch introduces a NULL deref. It sets tun_src to
NULL before the netns devices are removed, while set_tun_src() can
still read it.

I ran a stress test on net with KASAN. A userspace program sends UDP
packets in a loop from init_net through a veth into a test netns, where
a seg6 encap route without a per-route tunsrc forwards them. Meanwhile,
the test netns is created and deleted repeatedly.

With this patch applied, KASAN reported a null-ptr-deref in
set_tun_src() and the kernel panicked:

 BUG: KASAN: null-ptr-deref in set_tun_src+0xd1/0x240
 Read of size 8 at addr 0000000000000000 by task udp_flood_user/379
 Call Trace:
  <IRQ>
  set_tun_src+0xd1/0x240
  __seg6_do_srh_encap+0x410/0x710
  seg6_do_srh+0x65e/0x6a0
  seg6_input_core+0x87/0x4c0
  lwtunnel_input+0x18d/0x420
  ipv6_rcv+0x44f/0x460
  __netif_receive_skb_one_core+0xd6/0x130
  process_backlog+0x2cc/0xa00
  __napi_poll.constprop.0+0x56/0x270
  net_rx_action+0x327/0x730
  handle_softirqs+0x15a/0x6c0
  do_softirq+0xb4/0xf0
  </IRQ>
  <TASK>
  __local_bh_enable_ip+0xdd/0x100
  __dev_queue_xmit+0x538/0x1030
  ip6_finish_output+0x280/0x640
  ip6_output+0x118/0x380
  ip6_send_skb+0x99/0x210
  udp_v6_send_skb+0x397/0x760
  udpv6_sendmsg+0x1100/0x14d0
  __sys_sendto+0x219/0x2d0
  ...
 Kernel panic - not syncing: Fatal exception in interrupt

Without this patch, I ran the same test with 1000 netns deletions and
KASAN reported nothing.

Ciao,
Andrea