kernel/linux.git/net/ipv6/ip6mr.c, branch v7.2-rc2

ipmr: Convert mr_table.cache_resolve_queue_len to u32.

2026-06-11T22:17:30+00:00

mr_table.cache_resolve_queue_len is always updated under spin_lock_bh(&mfc_unres_lock). Let's convert it to u32. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260609222013.1550355-1-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Replace RTNL with a dedicated mutex for MFC.

2026-06-09T00:06:24+00:00

ip6mr does not have rtnetlink interface for MFC unlike ipmr, which uses dev_get_by_index_rcu() to set struct mfcctl.mfcc_parent. ip6mr_mfc_add() and ip6mr_mfc_delete() are called under RTNL from ip6_mroute_setsockopt() only. There are no RTNL dependant, but ip6_mroute_setsockopt() reuses RTNL just for mrt->mfc_hash and mrt->mfc_cache_list. Let's replace RTNL with a new per-netns mutex. Later, ip6mr_notifier_ops and ipmr_seq will be moved under CONFIG_IPV6_MROUTE. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-15-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Remove RTNL in ip6mr_rules_init() and ip6mr_net_init().

2026-06-09T00:06:24+00:00

When ip6mr_free_table() is called from ip6mr_rules_init() or ip6mr_net_init(), the netns is not yet published. Thus, no device should have been registered, and mroute_clean_tables() will not call mif6_delete(), so unregister_netdevice_many() is unnecessary. unregister_netdevice_many() does nothing if the list is empty, but it requires RTNL due to the unconditional ASSERT_RTNL() at the entry of unregister_netdevice_many_notify(). Let's remove unnecessary RTNL and ASSERT_RTNL() and instead add WARN_ON_ONCE() in ip6mr_free_table(). Note that we use a local list for the new WARN_ON_ONCE() because dev_kill_list passed from ip6mr_rules_exit_rtnl() may have some devices when other ops->init() fails after ipmr durnig setup_net(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-14-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Convert ip6mr_net_exit_batch() to ->exit_rtnl().

2026-06-09T00:06:24+00:00

ip6mr_net_ops uses ->exit_batch() to acquire RTNL only once for dying network namespaces. ip6mr does not depend on the ordering of ->exit_rtnl() and ->exit_batch() of other pernet_operations (unlike fib_net_ops). Once ip6mr_free_table() is called and all devices are queued for destruction in ->exit_rtnl(), later during NETDEV_UNREGISTER, ip6mr_device_event() will not see anything in vif table and just do nothing. Let's convert ip6mr_net_exit_batch() to ->exit_rtnl(). We will remove RTNL and unregister_netdevice_many() in ip6mr_rules_init(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-13-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Move unregister_netdevice_many() out of ip6mr_free_table().

2026-06-09T00:06:24+00:00

This is a prep commit to convert ip6mr_net_exit_batch() to ->exit_rtnl(). Let's move unregister_netdevice_many() in ip6mr_free_table() to its callers. Now ip6mr_rules_exit() can do batching all tables per netns. Note that later we will remove RTNL and unregister_netdevice_many() in ip6mr_rules_init(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-12-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Move unregister_netdevice_many() out of mroute_clean_tables().

2026-06-09T00:06:24+00:00

This is a prep commit to convert ip6mr_net_exit_batch() to ->exit_rtnl(). Let's move unregister_netdevice_many() in mroute_clean_tables() to its callers. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-11-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Call fib_rules_unregister() without RTNL.

2026-06-09T00:06:23+00:00

fib_rules_unregister() removes ops from net->rules_ops under spinlock, calls ops->delete() for each rule, and frees the ops. ip6mr_rules_ops_template does not have ->delete(), and any operation does not require RTNL there. Let's move fib_rules_unregister() from ip6mr_rules_exit() to ip6mr_net_exit(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-10-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Free mr_table after RCU grace period.

2026-06-09T00:06:23+00:00

Since default_device_exit_batch() is called after ->exit_rtnl(), idev->mc_ifc_work could finally call mroute6_is_socket() under RCU while ->exit_rtnl() is running. [0] With CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=n, ip6mr_fib_lookup() does not check if net->ipv6.mrt6 is NULL. If ip6mr_net_exit_batch() set net->ipv6.mrt6 to NULL and freed it, the mrt->mroute_sk access could result in null-ptr-deref or use-after-free. Let's prepare for that situation by applying RCU rule to ip6mr table similarly. !check_net(net) is added in ip6mr_cache_unresolved() and mroute_clean_tables() to synchronise the two by mfc_unres_lock so that ip6mr_cache_unresolved() will not queue skb after mroute_clean_tables() purged &mrt->mfc_unres_queue. rcu_read_lock() in reg_vif_xmit() is moved up to cover ip6mr_fib_lookup() as with ipmr. Link: https://lore.kernel.org/netdev/20260407184202.34cfe2d6@kernel.org/ #[0] Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-9-kuniyu@google.com Signed-off-by: Jakub Kicinski

net: Remove rtnl_held of struct fib_dump_filter.

2026-06-09T00:06:23+00:00

Commit 22e36ea9f5d7 ("inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU") introduced the rtnl_held field in struct fib_dump_filter to switch __dev_get_by_index() and dev_get_by_index_rcu() depending on the caller's context. This field served as an interim measure while we were incrementally converting all callers of ip_valid_fib_dump_req() to RCU. Now that all users (IPv4, IPv6, ipmr, ip6mr, and MPLS) have been converted to RCU, the field is no longer necessary. Let's remove it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-8-kuniyu@google.com Signed-off-by: Jakub Kicinski

ip6mr: Convert ip6mr_rtm_dumproute() to RCU.

2026-06-09T00:06:23+00:00

ip6mr_rtm_dumproute() calls mr_table_dump() or mr_rtm_dumproute(), and mr_rtm_dumproute() finally calls mr_table_dump(). mr_table_dump() calls the passed function, _ip6mr_fill_mroute(). _ip6mr_fill_mroute() is a wrapper for ip6mr_fill_mroute() to cast struct mr_mfc * to struct mfc6_cache *. ip6mr_fill_mroute() can already be called safely under RCU. Let's convert ip6mr_rtm_dumproute() to RCU. Now there is no user of the rtnl_held field in struct fib_dump_filter, and the next patch will remove it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-7-kuniyu@google.com Signed-off-by: Jakub Kicinski