Re: [PATCH net-next v2 2/3] ipv6: take fib6_sernum from a sequence shared by all netns

[Kuniyuki Iwashima]

On Mon, 19 Oct 2026 11:31:16 +0800, Qiliang Yuan wrote:
> A per-cpu IPv6 route of a nexthop object records fib6_sernum of the
> netns it was created in, and rt6_is_valid() compares it with fib6_sernum
> of the netns its device belongs to when the route is checked. Every netns
> starts its fib6_sernum at 1 and increments it on each tree change, so
> different netns often hold the same value.
> 
> When a device moves to another netns, such a route remains usable until
> nexthop_free_rcu() releases it, and fib6_info_destroy_rcu() queues that
> callback from inside an RCU callback, after the device has moved. If the
> fib6_sernum of the new netns matches the cached one in that window,
> ip6_dst_check() accepts the route and a socket in the old netns keeps
> sending through a device that now belongs to another netns.
> 
> Take every fib6_sernum bump from one sequence shared by all netns, which
> only hands out values from 2 up: every netns still starts at 1, and 0
> means there is no sernum to check. Every netns bumps its fib6_sernum
> when a route is inserted, so before a route through it can be cached,
> and the new netns does so before the moved device can transmit, when
> NETDEV_UP adds a route through it. A cached route therefore never
> matches the fib6_sernum of the netns its device moves to.
> fib6_new_sernum() callers only hold their own table's tb6_lock, so two
> tables of one netns can store their values in either order, and
> fib6_sernum is no longer monotonic per netns. It is only compared for
> equality, so this costs at most an extra invalidation.
> 
> A connected UDP socket in netns A caches a route through an IPv6 nexthop
> object on a veth. The veth is moved to netns B and brought up with one
> RTM_NEWLINK, then the socket sends 200000 datagrams. A route is added to
> and removed from B 0 to 20 times before the move, 63 trials:
> 
>                                 before     after
>   trials sending after move          1         0
>   datagrams sent after move        251         0
> 
> Fixes: 8f34e53b60b3 ("ipv6: Use global sernum for dst validation with nexthop objects")
> Signed-off-by: Qiliang Yuan <odys.yuan@xxxxxxxxx>

Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>