From: Nicolas Dichtel <nicolas.dich...@6wind.com>
Date: Wed, 12 Oct 2016 10:10:40 +0200
> The goal of the patch is to fix this scenario:
> ip link add dummy1 type dummy
> ip link set dummy1 up
> ip link set lo down ; ip link set lo up
> After that sequence, the local route to the link layer address of dummy1 is
> not there anymore.
> When the loopback is set down, all local routes are deleted by
> addrconf_ifdown()/rt6_ifdown(). At this time, the rt6_info entry still
> exists, because the corresponding idev has a reference on it. After the rcu
> grace period, dst_rcu_free() is called, and thus ___dst_free(), which will
> set obsolete to DST_OBSOLETE_DEAD.
> In this case, init_loopback() is called before dst_rcu_free(), thus
> obsolete is still sets to something <= 0. So, the function doesn't add the
> route again. To avoid that race, let's check the rt6 refcnt instead.
> Fixes: 25fb6ca4ed9c ("net IPv6 : Fix broken IPv6 routing table after loopback
> Fixes: a881ae1f625c ("ipv6: don't call addrconf_dst_alloc again when enable
> Fixes: 33d99113b110 ("ipv6: reallocate addrconf router for ipv6 address when
> lo device up")
> Reported-by: Francesco Santoro <francesco.sant...@6wind.com>
> Reported-by: Samuel Gauthier <samuel.gauth...@6wind.com>
> Signed-off-by: Nicolas Dichtel <nicolas.dich...@6wind.com>
Applied and queued up for -stable, thanks.