netdev - Re: [PATCH net-next v2] ipv6: clean up routes when manually removing address with a lifetime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fadbf374-0b3f-4c50-b3bd-26379664e9e4@kernel.org>
Date: Wed, 12 Nov 2025 22:11:24 -0700
From: David Ahern <dsahern@...nel.org>
To: Jakub Kicinski <kuba@...nel.org>, davem@...emloft.net
Cc: netdev@...r.kernel.org, edumazet@...gle.com, pabeni@...hat.com,
 andrew+netdev@...n.ch, horms@...nel.org, idosch@...dia.com
Subject: Re: [PATCH net-next v2] ipv6: clean up routes when manually removing
 address with a lifetime

On 11/12/25 8:17 PM, Jakub Kicinski wrote:
> When an IPv6 address with a finite lifetime (configured with valid_lft
> and preferred_lft) is manually deleted, the kernel does not clean up the
> associated prefix route. This results in orphaned routes (marked "proto
> kernel") remaining in the routing table even after their corresponding
> address has been deleted.
> 
> This is particularly problematic on networks using combination of SLAAC
> and bridges.
> 
> 1. Machine comes up and performs RA on eth0.
> 2. User creates a bridge
>    - does an ip -6 addr flush dev eth0;
>    - adds the eth0 under the bridge.
> 3. SLAAC happens on br0.
> 
> Even tho the address has "moved" to br0 there will still be a route
> pointing to eth0, but eth0 is not usable for IP any more.
> 
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
> Bit of a risky change.. but there's no known reason to intentionally
> keep these routes.
> 
> v2:
>  - fix up the test case
> v1: https://lore.kernel.org/20251111221033.3049292-1-kuba@kernel.org
> 
> CC: idosch@...dia.com
> CC: dsahern@...nel.org
> ---
>  net/ipv6/addrconf.c                      |  2 +-
>  tools/testing/selftests/net/rtnetlink.sh | 20 ++++++++++++++++++++
>  2 files changed, 21 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 40e9c336f6c5..b66217d1b2f8 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -1324,7 +1324,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
>  		__in6_ifa_put(ifp);
>  	}
>  
> -	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
> +	if (!(ifp->flags & IFA_F_NOPREFIXROUTE))
>  		action = check_cleanup_prefix_route(ifp, &expires);
>  

I was wandering the code earlier today. Could not find anything
obviously wrong with dropping that check, but putting into net-next for
a while will give some time for more testing by various groups.

Reviewed-by: David Ahern <dsahern@...nel.org>