Re: [PATCH net v4] ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

Hi Sebastian!

On Mon, Jan 12, 2026 at 04:49:47PM +0100, Sebastian Andrzej Siewior wrote:
> On 2025-12-23 13:14:12 [+0800], Jiayuan Chen wrote:
> > On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the
> > current task can be preempted. Another task running on the same CPU
> > may then execute rt6_make_pcpu_route() and successfully install a
> > pcpu_rt entry. When the first task resumes execution, its cmpxchg()
> > in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer
> > NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding
> > mdelay() after rt6_get_pcpu_route().
> > 
> > Using preempt_disable/enable is not appropriate here because
> > ip6_rt_pcpu_alloc() may sleep.
> > 
> > Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:
> > free our allocation and return the existing pcpu_rt installed by
> > another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT
> > kernels where such races should not occur.
> > 
> > Link: https://syzkaller.appspot.com/bug?extid=9b35e9bc0951140d13e6
> > Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
> > Reported-by: [email protected]
> > Closes: https://lore.kernel.org/all/[email protected]/T/
> > Signed-off-by: Jiayuan Chen <[email protected]>
> 
> This is upstream as commit
>    1adaea51c61b5 ("ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT")
> 
> and should be backported down to v6.12 due to the fixes tag. RT wise it
> should be broken since its introduction so if the stable team could take
> it down to v5.10-rt, that would be nice.

Just to clarify, do you mean us, the stable RT maintainers, or Greg-KH
and his merry band?

Best,
Luis