Patch "net: do not delay dst_entries_add() in dst_release()" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: do not delay dst_entries_add() in dst_release()

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-do-not-delay-dst_entries_add-in-dst_release.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bf8b85f2a40fef933fc666dbc347a14d02162627
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Tue Oct 8 14:31:10 2024 +0000

    net: do not delay dst_entries_add() in dst_release()
    
    [ Upstream commit ac888d58869bb99753e7652be19a151df9ecb35d ]
    
    dst_entries_add() uses per-cpu data that might be freed at netns
    dismantle from ip6_route_net_exit() calling dst_entries_destroy()
    
    Before ip6_route_net_exit() can be called, we release all
    the dsts associated with this netns, via calls to dst_release(),
    which waits an rcu grace period before calling dst_destroy()
    
    dst_entries_add() use in dst_destroy() is racy, because
    dst_entries_destroy() could have been called already.
    
    Decrementing the number of dsts must happen sooner.
    
    Notes:
    
    1) in CONFIG_XFRM case, dst_destroy() can call
       dst_release_immediate(child), this might also cause UAF
       if the child does not have DST_NOCOUNT set.
       IPSEC maintainers might take a look and see how to address this.
    
    2) There is also discussion about removing this count of dst,
       which might happen in future kernels.
    
    Fixes: f88649721268 ("ipv4: fix dst race in sk_dst_get()")
    Closes: https://lore.kernel.org/lkml/CANn89iLCCGsP7SFn9HKpvnKu96Td4KD08xf7aGtiYgZnkjaL=w@xxxxxxxxxxxxxx/T/
    Reported-by: Naresh Kamboju <naresh.kamboju@xxxxxxxxxx>
    Tested-by: Linux Kernel Functional Testing <lkft@xxxxxxxxxx>
    Tested-by: Naresh Kamboju <naresh.kamboju@xxxxxxxxxx>
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Xin Long <lucien.xin@xxxxxxxxx>
    Cc: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
    Reviewed-by: Xin Long <lucien.xin@xxxxxxxxx>
    Link: https://patch.msgid.link/20241008143110.1064899-1-edumazet@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/dst.c b/net/core/dst.c
index 95f533844f17f..9552a90d4772d 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -109,9 +109,6 @@ static void dst_destroy(struct dst_entry *dst)
 		child = xdst->child;
 	}
 #endif
-	if (!(dst->flags & DST_NOCOUNT))
-		dst_entries_add(dst->ops, -1);
-
 	if (dst->ops->destroy)
 		dst->ops->destroy(dst);
 	netdev_put(dst->dev, &dst->dev_tracker);
@@ -159,17 +156,27 @@ void dst_dev_put(struct dst_entry *dst)
 }
 EXPORT_SYMBOL(dst_dev_put);
 
+static void dst_count_dec(struct dst_entry *dst)
+{
+	if (!(dst->flags & DST_NOCOUNT))
+		dst_entries_add(dst->ops, -1);
+}
+
 void dst_release(struct dst_entry *dst)
 {
-	if (dst && rcuref_put(&dst->__rcuref))
+	if (dst && rcuref_put(&dst->__rcuref)) {
+		dst_count_dec(dst);
 		call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);
+	}
 }
 EXPORT_SYMBOL(dst_release);
 
 void dst_release_immediate(struct dst_entry *dst)
 {
-	if (dst && rcuref_put(&dst->__rcuref))
+	if (dst && rcuref_put(&dst->__rcuref)) {
+		dst_count_dec(dst);
 		dst_destroy(dst);
+	}
 }
 EXPORT_SYMBOL(dst_release_immediate);