From: Nicolas Dichtel <>
Date: Wed, 12 Oct 2016 10:10:40 +0200

> The goal of the patch is to fix this scenario:
>  ip link add dummy1 type dummy
>  ip link set dummy1 up
>  ip link set lo down ; ip link set lo up
> After that sequence, the local route to the link layer address of dummy1 is
> not there anymore.
> When the loopback is set down, all local routes are deleted by
> addrconf_ifdown()/rt6_ifdown(). At this time, the rt6_info entry still
> exists, because the corresponding idev has a reference on it. After the rcu
> grace period, dst_rcu_free() is called, and thus ___dst_free(), which will
> set obsolete to DST_OBSOLETE_DEAD.
> In this case, init_loopback() is called before dst_rcu_free(), thus
> obsolete is still sets to something <= 0. So, the function doesn't add the
> route again. To avoid that race, let's check the rt6 refcnt instead.
> Fixes: 25fb6ca4ed9c ("net IPv6 : Fix broken IPv6 routing table after loopback 
> down-up")
> Fixes: a881ae1f625c ("ipv6: don't call addrconf_dst_alloc again when enable 
> lo")
> Fixes: 33d99113b110 ("ipv6: reallocate addrconf router for ipv6 address when 
> lo device up")
> Reported-by: Francesco Santoro <>
> Reported-by: Samuel Gauthier <>
> Signed-off-by: Nicolas Dichtel <>

Applied and queued up for -stable, thanks.

Reply via email to