Re: [PATCH net v2 1/2] ipv6: serialize address publication with device teardown

[Ido Schimmel]

On Mon, Oct 05, 2026 at 03:36:38AM +0900, Daehyeon Ko wrote:
> ipv6_add_addr() checks idev state before allocating an ifaddr, but
> publishes the object later. addrconf_ifdown() can mark and detach the
> idev between the check and publication.
> 
> This happens when a non-loopback device MTU falls below IPV6_MIN_MTU. A
> forced interleaving published an address on a dead idev, and later device
> deletion waited indefinitely for the leaked references.
> 
> Protect the dead indication with idev->lock and keep that lock across
> both hash and device-list publication. Recheck both dead and
> disable_ipv6 before publishing. If teardown wins, reject the unpublished
> object.
> 
> Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>
> ---
>  net/ipv6/addrconf.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index c90ee6dd7446cd..426739abb07440 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -1168,14 +1168,20 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
>  
>  	rcu_read_lock();
>  
> -	err = ipv6_add_addr_hash(idev->dev, ifa);
> +	write_lock_bh(&idev->lock);
> +
> +	if (idev->dead)
> +		err = -ENODEV;
> +	else if (READ_ONCE(idev->cnf.disable_ipv6))
> +		err = -EACCES;

Why do you need this check? 'disable_ipv6' is not set under the idev
lock and it's checked earlier in the function. The fix here is strictly
about adding an address on a dead idev, as such an address will not be
cleaned up and keep holding a reference on the idev which in turn holds
a reference on the net device.

> +	else
> +		err = ipv6_add_addr_hash(idev->dev, ifa);
>  	if (err < 0) {
> +		write_unlock_bh(&idev->lock);
>  		rcu_read_unlock();
>  		goto out;
>  	}
>  
> -	write_lock_bh(&idev->lock);
> -
>  	/* Add to inet6_dev unicast addr list. */
>  	ipv6_link_dev_addr(idev, ifa);
>  
> @@ -3897,7 +3903,9 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
>  	 *	   Do not dev_put!
>  	 */
>  	if (unregister) {
> +		write_lock_bh(&idev->lock);
>  		WRITE_ONCE(idev->dead, 1);
> +		write_unlock_bh(&idev->lock);
>  
>  		/* protected by rtnl_lock */
>  		RCU_INIT_POINTER(dev->ip6_ptr, NULL);
> -- 
> 2.55.0
>