Re: [PATCH net v3] xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

2026/2/5 23:17, "David Ahern" <dsahern@kernel.org mailto:dsahern@kernel.org?to=%22David%20Ahern%22%20%3Cdsahern%40kernel.org%3E > 写到:

On 2/5/26 12:02 AM, Jiayuan Chen wrote:

quoted

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
 index 4abbec2f47ef..35816ac749bc 100644
 --- a/net/ipv4/icmp.c
 +++ b/net/ipv4/icmp.c
 @@ -554,6 +554,22 @@ static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4,
 /* steal dst entry from skb_in, don't drop refcnt */
 skb_dstref_steal(skb_in);
 skb_dstref_restore(skb_in, orefdst);
 +
 + /*
 + * At this point, fl4_dec.daddr should NOT be local (we
 + * checked fl4_dec.saddr above). However, a race condition
 + * may occur if the address is added to the interface
 + * concurrently. In that case, ip_route_input() returns a
 + * LOCAL route with dst.output=ip_rt_bug, which must not
 + * be used for output.
 + */
 + if (!err && rt2 && rt2->rt_type == RTN_LOCAL) {
 + net_warn_ratelimited("detected local route for %pI4 "
 + "during ICMP sending, src %pI4\n",
 + &fl4_dec.daddr, &fl4_dec.saddr);

per Paolo comment on the previous revision of this patch, strings should
not be split across lines like this. It should be:

net_warn_ratelimited("detected local route for %pI4 during ICMP sending,
src %pI4\n",

Sorry about that. I totally misunderstood Paolo's comment.

pw-bot: cr

quoted

+ dst_release(&rt2->dst);
 + err = -EINVAL;
 + }
 }
 
 if (err)