Re: [PATCH net v2] ipv6: prevent in6_dev_get() from resurrecting inet6_dev

[Ido Schimmel]

On Mon, Aug 03, 2026 at 12:27:57PM +0000, David Lee wrote:
> From: Kyle Zeng <kylebot@xxxxxxxxxx>
> 
> in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally
> increments its refcount. Device teardown can clear the pointer and drop
> the last reference between these operations. The increment then
> resurrects an object whose RCU free has already been queued, so callers
> can use it after it is freed.
> 
> Use refcount_inc_not_zero() and return NULL when the object has already
> reached zero. RCU keeps the memory accessible through the attempted
> reference acquisition, and a successful increment pins the object for
> the caller.
> 
> An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)
> kernel reproduced the invalid reference acquisition as UID 1000:
> 
>   refcount_t: addition on 0; use-after-free.
>   ip6_mc_source+0xef4/0x17e0
> 
> It was followed by the corresponding reference underflow in
> ip6_mc_source(). The supplied trace from the same unpatched revision
> additionally shows the access after the RCU read-side section ends:
> 
>   BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0
>   Write of size 8 at addr ffff888015b50240 by task poc/1219
> 
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
> 
> Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> Co-developed-by: David Lee <david.lee@xxxxxxxxxxxxxxx>
> Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>