Re: [PATCH net v3] xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
From: David Ahern <dsahern@kernel.org>
Date: 2026-02-05 15:17:20
Also in:
lkml
On 2/5/26 12:02 AM, Jiayuan Chen wrote:
quoted hunk ↗ jump to hunk
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 4abbec2f47ef..35816ac749bc 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c@@ -554,6 +554,22 @@ static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4, /* steal dst entry from skb_in, don't drop refcnt */ skb_dstref_steal(skb_in); skb_dstref_restore(skb_in, orefdst); + + /* + * At this point, fl4_dec.daddr should NOT be local (we + * checked fl4_dec.saddr above). However, a race condition + * may occur if the address is added to the interface + * concurrently. In that case, ip_route_input() returns a + * LOCAL route with dst.output=ip_rt_bug, which must not + * be used for output. + */ + if (!err && rt2 && rt2->rt_type == RTN_LOCAL) { + net_warn_ratelimited("detected local route for %pI4 " + "during ICMP sending, src %pI4\n", + &fl4_dec.daddr, &fl4_dec.saddr);
per Paolo comment on the previous revision of this patch, strings should
not be split across lines like this. It should be:
net_warn_ratelimited("detected local route for %pI4 during ICMP sending,
src %pI4\n",
+ dst_release(&rt2->dst); + err = -EINVAL; + } } if (err)