[PATCH net v4 0/4] ipv6: fix address publication races with addrconf_ifdown

[Daehyeon Ko]

The first patch removes each non-kept ifaddr from the address hash during
the per-device list cleanup. This prevents addrconf_ifdown() from freeing
a captured object that a late publisher left linked in the hash.

The second patch serializes hash and device-list publication with dead
device teardown. The cleanup patch is now first, so the newly atomic
publisher cannot create a captured-but-still-hashed intermediate state.

The third patch initializes a temporary address's public-ifaddr reference
and both timestamps before publication. No lifetime update can observe a
partially initialized relationship.

The fourth patch prevents stable-privacy DAD recovery from changing a
DEAD replacement address back to PREDAD and queueing work after teardown
has cleared its route.

The original deterministic test used a direct internal caller, kprobes and
atomic rendezvous at existing instruction boundaries. A real RA separately
reached ipv6_add_addr() with can_block=false. No new kernel build or
runtime test was run for v4. Validation used source review, strict
checkpatch and multi-tree apply tests.

Changes in v4:
- Reorder the first two patches so the hash cleanup precedes publication
  serialization; retain all existing patch subjects.
- Describe the freed hash entry as a use-after-free and document the mutual
  backport dependency in patches 1 and 2.
- Keep patch 2 scoped to idev->dead; drop the preliminary READ_ONCE()
  conversions and the unrelated disable_ipv6 recheck.
- State which finding was triggered and which follow-ons came from source
  review, including the observed device-teardown symptom.
- Initialize ifpub, cstamp and tstamp together in patch 3.
- Add patch 4 for the stable-privacy DAD recovery race.

Link: https://lore.kernel.org/r/20261009054042.272944-1-4ncienth@xxxxxxxxx
Link: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@xxxxxxxxxx
Link: https://lore.kernel.org/r/179161099539.434549.2238120015372268173@xxxxxxxxxx
Link: https://lore.kernel.org/r/179161099665.434549.5858601179492551889@xxxxxxxxxx
Link: https://lore.kernel.org/r/20261012145306.GB779501@shredder
Link: https://lore.kernel.org/r/20261012151316.GA798355@shredder
Link: https://lore.kernel.org/r/20261012145240.GA779501@shredder
Link: https://lore.kernel.org/r/179152464915.2527009.3889155025831898857@xxxxxxxxxx

Daehyeon Ko (4):
  ipv6: remove ifaddr from hash during ifdown list cleanup
  ipv6: serialize address publication with device teardown
  ipv6: initialize temporary ifaddr before publication
  ipv6: do not restart DAD for a dead ifaddr

 include/net/addrconf.h |  3 +++
 net/ipv6/addrconf.c    | 46 +++++++++++++++++++++++++++++++++-------------
 2 files changed, 36 insertions(+), 13 deletions(-)


base-commit: 513444cc62e231a11c9b15ea88de0890da9b2b4f
-- 
2.55.0