Re: [PATCH net-next 7/9] sit: dynamically allocate struct ip_tunnel_parm_kern

On Mon, Sep 7, 2026 at 3:35 PM Artem Lytkin [off-list ref] wrote:

On Mon, Sep 07, 2026 at 07:58:44AM +0000, Eric Dumazet wrote:

quoted

      ipip6_tunnel_unlink(sitn, t);
      synchronize_net();
-     t->parms.iph.saddr = p->iph.saddr;
-     t->parms.iph.daddr = p->iph.daddr;
+     t->sit_parms = new_p;

[...]

quoted

+     kfree(old_p);

At this point in the series old_p is freed with no grace period: the
synchronize_net() runs before the pointer switch and only covers the
hash readers. ipip6_tunnel_xmit() doesn't go through the hash and
keeps tiph = &tunnel->sit_parms->iph across the route lookup, and
ipip6_get_iflink() is reached from iflink_show() with no lock at all.
8/9 turns this into kfree_rcu(), so the end result is fine, but this
commit on its own is a UAF and breaks bisection. Moving the rcu_head
and kfree_rcu() here (or squashing 7 and 8) would keep each step safe.

Smaller thing of the same kind in 5/9: check_6rd() gets
rcu_dereference() but the rcu_read_lock() around the xmit path only
arrives in 8/9.

Yeah, I had to split my original patch into three parts because our
sashiko 5,000,000 token limit was hit.