Re: [PATCH net v4 2/4] ipv6: serialize address publication with device teardown

[Ido Schimmel]

On Thu, Oct 15, 2026 at 02:06:49PM +0900, Daehyeon Ko wrote:
> ipv6_add_addr() checks idev state before allocating an ifaddr, but
> publishes the object later. addrconf_ifdown() can mark and detach the
> idev between the check and publication.
> 
> This happens when a non-loopback device MTU falls below IPV6_MIN_MTU. A
> forced interleaving published an address on a dead idev, and
> ipv6_get_ifaddr() still returned it after teardown. Later device deletion
> remained blocked with:
> 
>   unregister_netdevice: waiting for ac0 to become free. Usage count = 3
> 
> Protect the dead indication with idev->lock and keep that lock across
> both hash and device-list publication. Recheck dead before publishing;
> if teardown wins the lock, reject the unpublished object.
> 
> Non-unregister teardown does not set dead. The preceding change covers an
> add that misses the initial hash scan but reaches the per-device list
> snapshot. Both changes are required when backporting this fix.
> 
> Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.")
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/r/179161099408.434549.14449036924552933828@xxxxxxxxxx
> Link: https://lore.kernel.org/r/20261012145306.GB779501@shredder
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>