ipv6: fix possible infinite loop in fib6_info_uses_dev()
authorEric Dumazet <edumazet@google.com>
Fri, 25 Jul 2025 14:07:24 +0000 (14:07 +0000)
committerJakub Kicinski <kuba@kernel.org>
Sat, 26 Jul 2025 18:31:00 +0000 (11:31 -0700)
commitf8d8ce1b515a0a6af72b30502670a406cfb75073
tree627174e0136ce27cb57a86f70318500042fdd976
parent54e6fe9dd3b0e7c481c2228782c9494d653546da
ipv6: fix possible infinite loop in fib6_info_uses_dev()

fib6_info_uses_dev() seems to rely on RCU without an explicit
protection.

Like the prior fix in rt6_nlmsg_size(),
we need to make sure fib6_del_route() or fib6_add_rt2node()
have not removed the anchor from the list, or we risk an infinite loop.

Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/route.c