Re: [PATCH net] seg6: fix tun_src RCU lifetime on namespace teardown

[Eric Dumazet]

Le lun. 26 oct. 2026 à 15:05, Andrea Mayer <andrea.mayer@xxxxxxxxxxx> a écrit :
>
> On Sun, 25 Oct 2026 22:22:22 +0000
> Tristan Madani <tristmd@xxxxxxxxx> wrote:
>
> > Found by manual code inspection while auditing RCU lifetime
> > patterns in the seg6 subsystem.  The issue is theoretical --
> > found by reading the source, not triggered in production.
>
> Hi Tristan,
> thanks for the info.
>
> The pre_exit in this patch introduces a NULL deref. It sets tun_src to
> NULL before the netns devices are removed, while set_tun_src() can
> still read it.
>
> I ran a stress test on net with KASAN. A userspace program sends UDP
> packets in a loop from init_net through a veth into a test netns, where
> a seg6 encap route without a per-route tunsrc forwards them. Meanwhile,
> the test netns is created and deleted repeatedly.
>
> With this patch applied, KASAN reported a null-ptr-deref in
> set_tun_src() and the kernel panicked:
>
>  BUG: KASAN: null-ptr-deref in set_tun_src+0xd1/0x240
>  Read of size 8 at addr 0000000000000000 by task udp_flood_user/379
>  Call Trace:
>   <IRQ>
>   set_tun_src+0xd1/0x240
>   __seg6_do_srh_encap+0x410/0x710
>   seg6_do_srh+0x65e/0x6a0
>   seg6_input_core+0x87/0x4c0
>   lwtunnel_input+0x18d/0x420
>   ipv6_rcv+0x44f/0x460
>   __netif_receive_skb_one_core+0xd6/0x130
>   process_backlog+0x2cc/0xa00
>   __napi_poll.constprop.0+0x56/0x270
>   net_rx_action+0x327/0x730
>   handle_softirqs+0x15a/0x6c0
>   do_softirq+0xb4/0xf0
>   </IRQ>
>   <TASK>
>   __local_bh_enable_ip+0xdd/0x100
>   __dev_queue_xmit+0x538/0x1030
>   ip6_finish_output+0x280/0x640
>   ip6_output+0x118/0x380
>   ip6_send_skb+0x99/0x210
>   udp_v6_send_skb+0x397/0x760
>   udpv6_sendmsg+0x1100/0x14d0
>   __sys_sendto+0x219/0x2d0
>   ...
>  Kernel panic - not syncing: Fatal exception in interrupt
>
> Without this patch, I ran the same test with 1000 netns deletions and
> KASAN reported nothing.
>
> Ciao,
> Andrea

Right, and there is no bug to fix in the first place.

ip6_segments_ops is a pernet subsys, so seg6_net_exit() runs after
all netns devices have been unregistered (default_device_exit_batch()
and the RCU grace periods in netdev_run_todo()). At that point no
packet can reach set_tun_src() for this netns, and no socket can
issue SEG6_CMD_GET_TUNSRC either.

pre_exit runs before devices are dismantled, hence the crash Andrea
reported.

pw-bot: rejected