Commit 9f72412bcf60 for kernel

commit 9f72412bcf60144f252b0d6205106abf14344abc
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date:   Wed May 27 13:31:30 2026 +0800

    ipv6: fix possible infinite loop in rt6_fill_node()

    Sashiko reported this issue [1]. Apply the same fix as
    commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()").

    Writers holding tb6_lock can list_del_rcu(&rt->fib6_siblings)
    without waiting for RCU readers; rt->fib6_siblings.next then still
    points into the old ring and this softirq-side walker never reaches
    &rt->fib6_siblings, causing a CPU stall. fib6_del_route() always
    WRITE_ONCE()s rt->fib6_nsiblings to 0 before list_del_rcu(), so an
    inside-loop check is a reliable detach signal.

    [1] https://sashiko.dev/#/patchset/20260526020227.4857-1-jiayuan.chen%40linux.dev

    Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn")
    Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Link: https://patch.msgid.link/20260527053133.180695-1-jiayuan.chen@linux.dev
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b106e5fef9cb..dad416fdc585 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5902,6 +5902,8 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,

 				goto nla_put_failure;
 			}
+			if (!READ_ONCE(rt->fib6_nsiblings))
+				break;
 		}

 		rcu_read_unlock();