[PATCH net v2 0/2] ipv6: fix address publication races with addrconf_ifdown

[Daehyeon Ko]

The first patch serializes address publication with device teardown by
taking idev->lock before the address hash lock, as suggested by Ido. It
rechecks both dead and disable_ipv6 before publishing.

The second patch fixes the related NETDEV_DOWN case, where the idev is
not marked dead. An address added after the initial hash scan can still
be captured by the per-device list snapshot. Remove it from the hash
before marking it dead, notifying listeners and dropping the list
reference.

The deterministic v1 test did not add delays to addrconf.c. A diagnostic
module used kprobes and atomic rendezvous at existing instruction
boundaries to force the interleaving. Separate, unmodified RA/MTU stress
did not win the race; the ambiguous sentence was removed from patch 1.

Changes in v2:
- Reverse the nested lock order, protect the dead indication with
  idev->lock, and recheck dead and disable_ipv6 before publication.
- Add a second patch for the NETDEV_DOWN WARN identified by Ido.
- Change patch 1's Fixes tag to 8814c4b53381.
- Clarify how the forced interleaving was produced.

Link: https://lore.kernel.org/r/20261001052150.136559-1-4ncienth@xxxxxxxxx

Daehyeon Ko (2):
  ipv6: serialize address publication with device teardown
  ipv6: remove ifaddr from hash during ifdown list cleanup

 net/ipv6/addrconf.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)


base-commit: 6dc989ea46b96ce170840174b4a38c4a387fb005
-- 
2.55.0