ipv6: use RCU protection in ip6_default_advmss()

[ Upstream commit 3c8ffcd248da34fc41e52a46e51505900115fc2a ]

ip6_default_advmss() needs rcu protection to make
sure the net structure it reads does not disappear.

Fixes: 5578689a4e3c ("[NETNS][IPV6] route6 - make route6 per namespace")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250205155120.1676781-11-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d7d600cb15a8d53379720087de532721e4005d7b..178c56f6f61858af3545a10ac017545c48735f42 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3056,13 +3056,18 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
 {
        struct net_device *dev = dst->dev;
        unsigned int mtu = dst_mtu(dst);
-       struct net *net = dev_net(dev);
+       struct net *net;
 
        mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
 
+       rcu_read_lock();
+
+       net = dev_net_rcu(dev);
        if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
                mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
 
+       rcu_read_unlock();
+
        /*
         * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
         * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.