Re: [PATCH net] ipv6: fix fib6 walker UAF on NLM_F_REPLACE

[Cen Zhang (Microsoft)]

Hi Jakub,

Sorry for the delayed reply. I'll send v2 shortly.

On Mon, 19 Oct 2026 17:09:09 -0700 Jakub Kicinski wrote:
> On Sat, 10 Oct 2026 22:55:27 +0000 netdev-bot+sashiko@xxxxxxxxxx wrote:
> > Should w->skip_in_node be reset here too?
>
> Sounds legit on the surface

Agreed. I'll address this in v2.

Regarding the other points in Sashiko's review:

> Can a resumed dump skip the replacement route rt here?
> [...] It moves walkers on iter to iter->fib6_next, which comes after
> rt [...] The dump then contains neither the old route nor its
> replacement for that prefix and metric

Yes, I reproduced this behavior with v1 applied. I'll address it in v2.

> can this store race with the lockless walker reset in
> fib6_dump_table()? [...] The same race already existed with
> fib6_del_route() as the writer.

I agree this is a pre-existing issue. I'll leave it out of v2 to keep
this change focused.

Thanks,
Cen