[PATCH net-next 0/9] sit: convert configuration to RCU and lockless fill_info

SIT (IPv6-in-IPv4) tunnel configuration and status reporting have
historically relied on the RTNL lock for synchronization. Consequently,
netlink dumps via ipip6_fill_info() had to run with RTNL held, adding
contention during network device dumps.

At the same time, the transmit path (dev->lltx == true), tunnel lookups,
and error handling run locklessly and can race with configuration
updates. This can result in torn reads of multi-word fields (such as the
128-bit 6RD IPv6 prefix) or transiently zeroed encapsulation parameters.
Furthermore, ipip6_tunnel_update() currently unhashes, re-hashes, and
calls synchronize_net() unconditionally, even when the tunnel endpoint
addresses (saddr and daddr) have not changed.

This patch series addresses PRL issues, modernizes SIT parameter
management to use RCU protection, optimizes tunnel updates, and removes
the RTNL requirement from ipip6_fill_info():

- Patch 1 fixes a pre-existing UAF in PRL (Potential Router List)
  deletion where call_rcu() was invoked before unlinking t->prl.
- Patch 2 adds GFP_KERNEL_ACCOUNT to struct ip_tunnel_prl_entry
  allocations in ipip6_tunnel_add_prl().
- Patch 3 removes the unsafe in-place memset() in ip_tunnel_encap_setup()
  and uses WRITE_ONCE() to prevent lockless readers from observing
  transiently zeroed or torn fields.
- Patch 4 annotates data races on tunnel->fwmark with READ_ONCE() and
  WRITE_ONCE().
- Patch 5 converts 6RD configuration (tunnel->ip6rd) to an RCU-protected
  pointer, preventing torn reads on the 128-bit IPv6 prefix.
- Patch 6 implements a dedicated ipip6_get_iflink() callback to decouple
  SIT parameter handling from generic ip_tunnel.
- Patch 7 dynamically allocates struct ip_tunnel_parm_kern (sit_parms)
  as a preparatory step.
- Patch 8 converts tunnel->sit_parms to full RCU protection. Updates
  publish new parameters via rcu_assign_pointer() and free the old ones
  via kfree_rcu(). When saddr and daddr do not change, unhashing,
  re-hashing, and synchronize_net() are completely bypassed.
- Patch 9 wraps attribute serialization in ipip6_fill_info() under
  rcu_read_lock(), eliminating the reliance on the RTNL lock.

Eric Dumazet (9):
  sit: fix UAF in ipip6_tunnel_del_prl()
  sit: charge ip_tunnel_prl_entry allocations to memcg
  ip_tunnel: use WRITE_ONCE in ip_tunnel_encap_setup
  sit: annotate data-races around tunnel->fwmark
  sit: convert 6RD configuration to RCU protection
  sit: implement ipip6_get_iflink()
  sit: dynamically allocate struct ip_tunnel_parm_kern
  sit: convert configuration to RCU protection
  sit: no longer rely on RTNL in ipip6_fill_info()

 include/net/ip_tunnels.h |   5 +-
 net/ipv4/ip_tunnel.c     |  14 +-
 net/ipv6/sit.c           | 477 +++++++++++++++++++++++++++------------
 3 files changed, 339 insertions(+), 157 deletions(-)

-- 
2.55.0.979.g7e5102b832-goog