Re: [PATCH net v4 3/4] ipv6: initialize temporary ifaddr before publication

[Ido Schimmel]

On Thu, Oct 15, 2026 at 02:06:50PM +0900, Daehyeon Ko wrote:
> ipv6_create_tempaddr() holds a reference to the public ifaddr, publishes
> the new temporary address through ipv6_add_addr(), and only then stores
> the reference and final timestamps.
> 
> addrconf_ifdown() can remove the temporary address before ifpub is
> stored, leaking the public ifaddr reference. Publishing ifpub alone is
> insufficient: manage_tempaddrs() can then find the object before cstamp
> and tstamp are final, update its lifetimes, and have the constructor
> overwrite its timestamp with an older value.
> 
> This follow-on was found by source review and was not separately
> triggered at runtime.
> 
> Pass the public ifaddr and both timestamps in ifa6_config. Initialize all
> three fields before adding the temporary address to either the hash or
> per-device lists. On success the existing public-ifaddr reference
> transfers to the temporary object. On error it remains owned and released
> by ipv6_create_tempaddr().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Sashiko <netdev-bot+sashiko@xxxxxxxxxx>
> Closes: https://lore.kernel.org/r/179122559913.434549.12720841717630168470@xxxxxxxxxx
> Link: https://lore.kernel.org/r/179161099665.434549.5858601179492551889@xxxxxxxxxx
> Link: https://lore.kernel.org/r/20261007164548.GA1153540@shredder
> Link: https://lore.kernel.org/r/20261012145240.GA779501@shredder
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>

FTR, I suggested a smaller diff [1] which you decided to change without
a comment. Tagging this one because it fixes the problem and because I
want to put this frustrating submission behind me.

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>

[1] https://lore.kernel.org/netdev/20261007192032.GA1212364@shredder/