ipv4: use RCU protection in ipv4_default_advmss()

[ Upstream commit 71b8471c93fa0bcab911fcb65da1eb6c4f5f735f ]

ipv4_default_advmss() must use RCU protection to make
sure the net structure it reads does not disappear.

Fixes: 2e9589ff809e ("ipv4: Namespaceify min_adv_mss sysctl knob")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250205155120.1676781-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2a27913588d05a2074f589f9d7440a846d96d5e8..9709ec3e2dce644d8e1c48f5972a74e57cc7c69f 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1294,10 +1294,15 @@ static void set_class_tag(struct rtable *rt, u32 tag)
 
 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
 {
-       struct net *net = dev_net(dst->dev);
        unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr);
-       unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
-                                   net->ipv4.ip_rt_min_advmss);
+       unsigned int advmss;
+       struct net *net;
+
+       rcu_read_lock();
+       net = dev_net_rcu(dst->dev);
+       advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+                                  net->ipv4.ip_rt_min_advmss);
+       rcu_read_unlock();
 
        return min(advmss, IPV4_MAX_PMTU - header_size);
 }