Re: [PATCH net] ipv6: anycast: insert aca into global hash under idev->lock

[Jiayuan Chen]

On 5/29/26 1:10 PM, Kuniyuki Iwashima wrote:
> On Thu, May 28, 2026 at 10:03 PM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
> > On 5/29/26 11:41 AM, Kuniyuki Iwashima wrote:
> > > On Thu, May 28, 2026 at 8:20 PM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
> > > > syzbot reported a splat [1]: a slab-use-after-free in
> > > > ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash
> > > > under RCU and dereferences a struct ifacaddr6 that has already been
> > > > freed while still linked in the hash, so a later reader walks into a
> > > > dangling node.
> > > >
> > > > In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then
> > > > aca_get() bumps it to 2 to keep it alive across the unlocked region.
> > > > It is published to idev->ac_list under idev->lock, but
> > > > ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent
> > > > teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL)
> > > > can slip into that window:
> > > >
> > > >     CPU0 __ipv6_dev_ac_inc           CPU1 ipv6_ac_destroy_dev (RTNL)
> > > >     ------------------------------   ------------------------------------
> > > >     aca_alloc()              refcnt 1
> > > >     aca_get()               refcnt 2
> > > >     write_lock_bh(idev->lock)
> > > >       add aca to ac_list
> > > >     write_unlock_bh(idev->lock)
> > > >                                      write_lock_bh(idev->lock)
> > > >                                        pull aca off ac_list
> > > >                                      write_unlock_bh(idev->lock)
> > > >                                      ipv6_del_acaddr_hash(aca)
> > > >                                        hlist_del_init_rcu() is a no-op,
> > > >                                        aca is not in the hash yet
> > > >                                      aca_put()           refcnt 2->1
> > > >     ipv6_add_acaddr_hash(aca)
> > > >       aca now inserted into the hash
> > > >     aca_put()                refcnt 1->0
> > > >       call_rcu(aca_free_rcu) -> kfree(aca)
> > > >
> > > > The hash removal becomes a no-op because the insertion has not
> > > > happened yet, so once CPU0 inserts and drops the last reference, the
> > > > aca is freed while still linked in inet6_acaddr_lst[], and readers
> > > > dereference freed memory after the slab slot is reused.
> > > >
> > > > This window opened once RTNL stopped serializing the join path against
> > > > device teardown. Move ipv6_add_acaddr_hash() inside the idev->lock
> > > > section so the ac_list and hash insertions are atomic with respect to
> > > > teardown: a racing remover now either misses the aca entirely or finds
> > > > it in both lists.
> > > >
> > > > [1] https://syzkaller.appspot.com/bug?extid=a01df04303c131efbf3a
> > > Closes: and Reported-by ?
> >
> >
> > It has already been closed automatically, so I didn't add a Closes tag.
> > As for the Reported-by tag, it should be carried along with the patch.
> Closes: is not related to the status in the syzbot dashboard.
>
> Also, the moderation is the stage before being sent upstream,
> not that the report is closed, I just published it.
>
> So please add both tags using this link and Reported-by
> tag there.
>
> https://lore.kernel.org/netdev/6a191f87.ce022c6e.138e56.0003.GAE@xxxxxxxxxx/T/

Thanks, I find this report now.

I will carry both tags.

> > I'll pay attention next time. :)
> >
> > > > Fixes: eb1ac9ff6c4a ("ipv6: anycast: Don't hold RTNL for IPV6_JOIN_ANYCAST.")
> > > > Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> > > Change itself looks good, thanks
> > >
> > > Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> > >
> > >
> > > > ---
> > > >    net/ipv6/anycast.c | 4 ++--
> > > >    1 file changed, 2 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
> > > > index 67a42e01dfc3..cd8c02a1ad4c 100644
> > > > --- a/net/ipv6/anycast.c
> > > > +++ b/net/ipv6/anycast.c
> > > > @@ -371,10 +371,10 @@ int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr)
> > > >           aca->aca_next = idev->ac_list;
> > > >           rcu_assign_pointer(idev->ac_list, aca);
> > > >
> > > > -       write_unlock_bh(&idev->lock);
> > > > -
> > > >           ipv6_add_acaddr_hash(net, aca);
> > > >
> > > > +       write_unlock_bh(&idev->lock);
> > > > +
> > > >           ip6_ins_rt(net, f6i);
> > > >
> > > >           addrconf_join_solict(idev->dev, &aca->aca_addr);
> > > > --
> > > > 2.43.0