Re: [PATCH net v2] ipv6: prevent in6_dev_get() from resurrecting inet6_dev
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <178588260564.3813627.866249845630224776.git-patchwork-notify@kernel.org> |
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>: On Mon, 3 Aug 2026 12:27:57 +0000 you wrote: > From: Kyle Zeng <[email protected]> > > in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally > increments its refcount. Device teardown can clear the pointer and drop > the last reference between these operations. The increment then > resurrects an object whose RCU free has already been queued, so callers > can use it after it is freed. > > [...] Here is the summary with links: - [net,v2] ipv6: prevent in6_dev_get() from resurrecting inet6_dev https://git.kernel.org/netdev/net/c/0e243671bc7b You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html