ipv6: use RCU protection in ip6_default_advmss()

[ Upstream commit 3c8ffcd248da34fc41e52a46e51505900115fc2a ]

ip6_default_advmss() needs rcu protection to make
sure the net structure it reads does not disappear.

Fixes: 5578689a4e3c ("[NETNS][IPV6] route6 - make route6 per namespace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250205155120.1676781-11-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f3268bac9f198d9092f09960fe0cc28e4f0437f8..17918f411386ab97ce3b0f2e4aaca48c3becc20e 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3190,13 +3190,18 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
 {
        struct net_device *dev = dst->dev;
        unsigned int mtu = dst_mtu(dst);
-       struct net *net = dev_net(dev);
+       struct net *net;
 
        mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
 
+       rcu_read_lock();
+
+       net = dev_net_rcu(dev);
        if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
                mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
 
+       rcu_read_unlock();
+
        /*
         * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
         * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.