neighbour: Remove __pneigh_lookup().

__pneigh_lookup() is the lockless version of pneigh_lookup(),
but its only caller pndisc_is_router() holds the table lock and
reads pneigh_netry.flags.

This is because accessing pneigh_entry after pneigh_lookup() was
illegal unless the caller holds RTNL or the table lock.

Now, pneigh_entry is guaranteed to be alive during the RCU critical
section.

Let's call pneigh_lookup() and use READ_ONCE() for n->flags in
pndisc_is_router() and remove __pneigh_lookup().

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250716221221.442239-13-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 6d7f9aa53a7a90e19e67f452168d9c8a9f749ea1..f8c7261cd4ebb0ab5ea5884b176c928f85fe28ca 100644 (file)
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -381,8 +381,6 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
                    struct sk_buff *skb);
 struct pneigh_entry *pneigh_lookup(struct neigh_table *tbl, struct net *net,
                                   const void *key, struct net_device *dev);
-struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl, struct net *net,
-                                    const void *key, struct net_device *dev);
 struct pneigh_entry *pneigh_create(struct neigh_table *tbl, struct net *net,
                                   const void *key, struct net_device *dev);
 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *key,

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b76ff416b9a7aaa8bc0c0e70b057eae282bf4ec9..e7bd8111f97f4b0590988a93ab58714e0a137760 100644 (file)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -737,17 +737,6 @@ static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
        return NULL;
 }
 
-struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
-               struct net *net, const void *pkey, struct net_device *dev)
-{
-       unsigned int key_len = tbl->key_len;
-       u32 hash_val = pneigh_hash(pkey, key_len);
-
-       return __pneigh_lookup_1(rcu_dereference_protected(tbl->phash_buckets[hash_val], 1),
-                                net, pkey, key_len, dev);
-}
-EXPORT_SYMBOL_GPL(__pneigh_lookup);
-
 struct pneigh_entry *pneigh_lookup(struct neigh_table *tbl,
                                   struct net *net, const void *pkey,
                                   struct net_device *dev)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index a3ac26c1df6d81f2f58762d5911cab50a70e7caf..7d5abb3158ec9640a45d4f36fbbfdfce070c0dd0 100644 (file)
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -768,11 +768,9 @@ static int pndisc_is_router(const void *pkey,
        struct pneigh_entry *n;
        int ret = -1;
 
-       read_lock_bh(&nd_tbl.lock);
-       n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
+       n = pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
        if (n)
-               ret = !!(n->flags & NTF_ROUTER);
-       read_unlock_bh(&nd_tbl.lock);
+               ret = !!(READ_ONCE(n->flags) & NTF_ROUTER);
 
        return ret;
 }