Re: [PATCH] ipv6: prevent in6_dev_get() from resurrecting inet6_dev

[Ido Schimmel]

In addition to the other process comments you got, subject prefix should
have been "[PATCH net]" ("[PATCH net v2]" now). See:

https://docs.kernel.org/process/maintainer-netdev.html

Get the process right with one patch, then send the rest.

On Fri, Jul 31, 2026 at 01:52:01PM +0000, David Lee wrote:
> in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally
> increments its refcount. Device teardown can clear the pointer and drop
> the last reference between these operations. The increment then
> resurrects an object whose RCU free has already been queued, so callers
> can use it after it is freed.
> 
> Use refcount_inc_not_zero() and return NULL when the object has already
> reached zero. RCU keeps the memory accessible through the attempted
> reference acquisition, and a successful increment pins the object for
> the caller.
> 
> Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.
> 
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> ---
> Trail of Bits has a reproducer for this bug that triggers
> a KASAN use-after-free and can share if needed.

Didn't you see an "addition on 0; use-after-free" trace before KASAN?
Please include it in the commit message.

Was the bug reproduced on an unpatched kernel?

Also, what about IPv4? in_dev_get() has the same structure and at least
inet_netconf_get_devconf() is calling it without holding RTNL.