W dniu 2/3/26 o 09:21, Paolo Abeni pisze:

On 1/27/26 8:04 AM, Marek Mietus wrote:

quoted

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index cf37ad9686e6..a0d699082747 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c

@@ -1028,6 +1028,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 
 	iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl,
 		      df, !net_eq(tunnel->net, dev_net(dev)), 0);
+	ip_rt_put(rt);
 	return NETDEV_TX_OK;
 
 tx_error_icmp:

Could you please double check that all ndo_start_xmit caller are under
RCU protection?

The docs in Documentation/networking/netdevices.rst mention that ndo_start_xmit
is called from a BH context or from a process context with BHs disabled.

Ever since the consolidation of the different RCU flavors, running with BHs
disabled implies an RCU read-side critical section. This is mentioned in the docs
for rcu_read_lock_bh.

Specifically I don't see it in the
xsk_generic_xmit()/__dev_direct_xmit() path.

As for this, __dev_direct_xmit() calls local_bh_disable() before calling
netdev_start_xmit(), which eventually calls ops->ndo_start_xmit().

/P