Re: [PATCH net-next v2 1/2] seg6: skip the route refcount in seg6local IPv6 lookups

[Yuya Kusakabe]

On Wed, 14 Oct 2026 01:58:19 +0200
Andrea Mayer <andrea.mayer@xxxxxxxxxxx> wrote:

> For a packet queued with NFQUEUE, the okfn runs later from nf_reinject(),
> under the rcu_read_lock() of the nfnetlink verdict handler. Is "that same
> section" accurate for that case?

No, it is not.  The lookup and dst_input() still run within one RCU
read-side section, but for a reinjected packet it is the one of the
verdict handler.  v3 will say so in both patches.

> With RT6_LOOKUP_F_DST_NOREF, ip6_pol_route() no longer calls
> ip6_hold_safe(). If the route it finds is released on another CPU during
> the lookup, the packet can be dropped without an ICMP error. Before the
> series, when ip6_hold_safe() did not get the reference on the released
> route, the packet went to the next policy rule, or to ip6_null_entry and
> its ICMPv6 Destination Unreachable. As far as I can see, only packets that
> race with the release are affected. It is still a change in behavior, and
> it would be worth at least mentioning it in the commit message.

Agreed.  v3 will mention it in the 1/2 message, along with the fact
that ip6_route_input() has the same window.

> It would be good to keep seg6_lookup_nexthop() unchanged for the BPF
> helpers, also while a route is being released. One idea, as a refinement of
> the split, could be a common lookup function with a noref argument. For
> example, seg6_lookup_any_nexthop_noref() would call it with noref set, and
> seg6_lookup_nexthop() with noref clear, keeping the refcounted lookup it
> had before the series. What do you think?

That works better.  In v3, seg6_lookup_any_nexthop() will take a noref
argument, seg6_lookup_any_nexthop_noref() will set it for the seg6local
input actions, and seg6_lookup_nexthop() will keep its refcounted
lookup.  The skb_dst_force() fallback goes away, and with it the
-EINVAL that Sashiko pointed out.

pw-bot: cr