Re: [PATCH net v4 1/4] ipv6: remove ifaddr from hash during ifdown list cleanup

[Ido Schimmel]

On Thu, Oct 15, 2026 at 02:06:48PM +0900, Daehyeon Ko wrote:
> addrconf_ifdown() clears the address hash before snapshotting the
> per-device address list. A concurrent ipv6_add_addr() can publish an
> address after the hash scan and before the list snapshot.
> 
> The ifdown path then removes the address from the device list and drops
> the list-owned reference while it is still linked in the hash. Once the
> remaining references are released, inet6_ifa_finish_destroy() warns, but
> a DEAD address continues to kfree_rcu(). The hash therefore points to
> freed memory that later RCU walkers can dereference.
> 
> This follow-on was found by source review and was not separately
> triggered at runtime.
> 
> Remove each non-kept address from the hash immediately before removing
> it from the per-device list. Keeping it hashed through the delete
> notification blocks same-address publication until NETDEV_DOWN has been
> delivered. hlist_del_init_rcu() is safe when the earlier hash scan
> already removed the address.
> 
> This handles a late publisher captured by the list snapshot. The next
> change serializes publication with teardown so an add cannot miss both
> observations. Both changes are required when backporting the complete fix.
> 
> Fixes: 73a8bd74e261 ("ipv6: Revert 'administrative down' address handling changes.")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Link: https://lore.kernel.org/r/20261004135117.GA206930@shredder
> Link: https://lore.kernel.org/r/179161099539.434549.2238120015372268173@xxxxxxxxxx
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>