netdev - [REGRESSION] IPv6 RA default router advertisement fails after kernel 6.12.42 updates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACBcRwK8wUbJ_S=z4QQg_CGfVWQaMd6HktdNCRkfG22Ypgg63w@mail.gmail.com>
Date: Thu, 21 Aug 2025 07:14:12 +0800
From: 喵公子 <miaogongzi0227@...il.com>
To: stable@...r.kernel.org, netdev@...r.kernel.org
Cc: Greg KH <gregkh@...uxfoundation.org>, regressions@...ts.linux.dev, 
	edumazet@...gle.com, kuba@...nel.org, sashal@...nel.org, 
	yoshfuji@...ux-ipv6.org
Subject: [REGRESSION] IPv6 RA default router advertisement fails after kernel
 6.12.42 updates

Hi,

While testing Linux kernel 6.12.42 on OpenWrt, we observed a
regression in IPv6 Router Advertisement (RA) handling for the default
router.

Affected commits

The following commits appear related and may have introduced the issue:

ipv6: fix possible infinite loop in fib6_info_uses_dev()：
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.42&id=db65739d406c72776fbdbbc334be827ef05880d2

ipv6: prevent infinite loop in rt6_nlmsg_size()：
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.42&id=cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38

ipv6: annotate data-races around rt->fib6_nsiblings：
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.42&id=0c58f74f8aa991c2a63bb58ff743e1ff3d584b62

Problem description：

In Linux kernel 6.12.42, IPv6 FIB multipath and concurrent access
handling was made stricter (READ_ONCE / WRITE_ONCE + RCU retry).

The RA “Automatic” mode relies on checking whether a local default route exists.

With the stricter FIB handling, this check can fail in multipath scenarios.

As a result, RA does not advertise a default route, and IPv6 clients
on LAN fail to receive the default gateway.

Steps to reproduce

Run OpenWrt with kernel 6.12.42 (or 6.12.43) on a router with br-lan bridge.

Configure IPv6 RA in Automatic default router mode.

Observe that no default route is advertised to clients (though
prefixes may still be delivered).

Expected behavior

Router Advertisement should continue to advertise the default route as
in kernel 6.12.41 and earlier.

Client IPv6 connectivity should not break.

Actual behavior

RA fails to advertise a default route in Automatic mode.

Clients do not install a default IPv6 route → connectivity fails.

Temporary workaround

Change RA default router mode from Automatic → Always / Use available
prefixes in OpenWrt.

This bypasses the dependency on local default route check and restores
correct RA behavior.

Additional notes

This appears to be an unintended side effect of the stricter FIB
handling changes introduced in 6.12.42. Please advise if this has
already been reported or if I should prepare a minimal reproducer
outside OpenWrt.

Thanks,
[GitHub: mgz0227]