Re: [net-next,v5,10/11] net: sit: convert ipip6_tunnel_xmit to use a noref dst
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-01-18 00:36:14
This is an AI-generated review of your patch. The human sending this email has considered the AI review valid, or at least plausible. For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html --- net: sit: convert ipip6_tunnel_xmit to use a noref dst This patch converts ipip6_tunnel_xmit to use dst_cache_get_ip4_rcu() and dst_cache_steal_ip4() to avoid redundant refcount increments when using the dst cache.
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index a0d699082747..e9183e502242 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c@@ -933,14 +933,14 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, IPPROTO_IPV6, 0, dst, tiph->saddr, 0, 0, sock_net_uid(tunnel->net, NULL)); - rt = dst_cache_get_ip4(&tunnel->dst_cache, &fl4.saddr); + rt = dst_cache_get_ip4_rcu(&tunnel->dst_cache, &fl4.saddr); if (!rt) { rt = ip_route_output_flow(tunnel->net, &fl4, NULL); if (IS_ERR(rt)) { DEV_STATS_INC(dev, tx_carrier_errors); goto tx_error_icmp; } - dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst, fl4.saddr); + dst_cache_steal_ip4(&tunnel->dst_cache, &rt->dst, fl4.saddr); } if (rt->rt_type != RTN_UNICAST && rt->rt_type != RTN_LOCAL) { ip_rt_put(rt); DEV_STATS_INC(dev, tx_carrier_errors); goto tx_error_icmp; }
When rt is obtained from dst_cache_get_ip4_rcu() (cache hit path), no reference is taken on the dst. However, the ip_rt_put(rt) call here was not removed. If the cache returns a valid rt but the rt_type check fails, this will call dst_release() on a dst we do not own a reference to. Could this cause a refcount underflow? The correct pattern (as seen in ip_tunnel_xmit()) uses a noref boolean to track whether we own a reference, and only calls ip_rt_put() when !noref. [ ... ]