Eric DumazetandSasha Levin e23da16dec ipv6: fix a race in ip6_sock_set_v6only() ...

[ Upstream commit 452a3eee22 ]

It is unlikely that this function will be ever called
with isk->inet_num being not zero.

Perform the check on isk->inet_num inside the locked section
for complete safety.

Fixes: 9b115749ac ("ipv6: add ip6_sock_set_v6only")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260216102202.3343588-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-04 07:20:06 -05:00

..

9p

…

bluetooth

Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'

2025-12-07 06:12:34 +09:00

caif

…

iucv

…

netfilter

netfilter: nf_conncount: increase the connection clean up limit to 64

2026-03-04 07:19:40 -05:00

netns

xfrm: fix a data-race in xfrm_gen_index()

2023-10-25 12:03:06 +02:00

nfc

nfc: nci: Fix race between rfkill and nci_unregister_device().

2026-02-06 16:44:16 +01:00

phonet

…

sctp

sctp: detect and prevent references to a freed transport in sendmsg

2025-04-25 10:43:43 +02:00

tc_act

net_sched: act_connmark: use RCU in tcf_connmark_dump()

2025-12-07 06:12:33 +09:00

6lowpan.h

…

act_api.h

…

addrconf.h

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

2024-04-17 11:18:24 +02:00

af_ieee802154.h

…

af_rxrpc.h

…

af_unix.h

af_unix: Try not to hold unix_gc_lock during accept().

2025-06-04 14:40:24 +02:00

af_vsock.h

…

ah.h

…

amt.h

…

arp.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

atmclip.h

…

ax25.h

ax25: rcu protect dev->ax25_ptr

2025-02-21 13:49:02 +01:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

bonding: Add independent control state machine

2025-08-28 16:26:18 +02:00

bond_alb.h

…

bond_options.h

bonding: Add independent control state machine

2025-08-28 16:26:18 +02:00

bonding.h

bonding: annotate data-races around slave->last_rx

2026-02-06 16:44:15 +01:00

bpf_sk_storage.h

…

busy_poll.h

net: busy-poll: use ktime_get_ns() instead of local_clock()

2024-09-04 13:25:02 +02:00

calipso.h

…

cfg80211-wext.h

…

cfg80211.h

cfg80211: support RNR for EMA AP

2026-01-11 15:18:59 +01:00

cfg802154.h

mac802154: fix llsec key resources release in mac802154_llsec_key_del

2024-04-03 15:19:31 +02:00

checksum.h

net: Fix checksum update for ILA adj-transport

2025-06-27 11:07:38 +01:00

cipso_ipv4.h

…

cls_cgroup.h

net/cls_cgroup: Fix task_get_classid() during qdisc run

2025-12-07 06:12:24 +09:00

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

…

dropreason.h

…

dsa.h

net: dsa: add support for mac_prepare() and mac_finish() calls

2025-05-02 07:46:50 +02:00

dsfield.h

…

dst_cache.h

…

dst_metadata.h

…

dst_ops.h

net: fix __dst_negative_advice() race

2024-06-16 13:41:40 +02:00

dst.h

net: Add locking to protect skb->dev access in ip_output

2026-01-17 16:39:28 +01:00

erspan.h

…

esp.h

…

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

…

firewire.h

…

flow_dissector.h

…

flow_offload.h

…

flow.h

ipv4: Drop tos parameter from flowi4_update_output()

2025-05-18 08:21:21 +02:00

fou.h

…

fq_impl.h

…

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

genetlink: hold RCU in genlmsg_mcast()

2024-11-01 01:56:00 +01:00

geneve.h

…

gre.h

…

gro_cells.h

…

gro.h

…

gtp.h

…

gue.h

…

hwbm.h

…

icmp.h

…

ieee80211_radiotap.h

…

ieee802154_netdev.h

…

if_inet6.h

net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX

2023-12-20 17:00:15 +01:00

ife.h

…

ila.h

…

inet6_connection_sock.h

…

inet6_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_common.h

inet: factor out locked section of inet_accept() in a new helper

2024-06-12 11:03:53 +02:00

inet_connection_sock.h

tcp/dccp: allow a connection when sk_max_ack_backlog is zero

2025-01-17 13:34:38 +01:00

inet_dscp.h

…

inet_ecn.h

…

inet_frag.h

…

inet_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_sock.h

udp: fix busy polling

2024-01-31 16:17:04 -08:00

inet_timewait_sock.h

tcp/dccp: do not care about families in inet_twsk_purge()

2024-08-29 17:30:44 +02:00

inetpeer.h

inetpeer: remove create argument of inet_getpeer()

2025-02-21 13:49:01 +01:00

ioam6.h

…

ip6_checksum.h

…

ip6_fib.h

…

ip6_route.h

ipv6: fix source address selection with route leak

2024-08-14 13:53:02 +02:00

ip6_tunnel.h

…

ip_fib.h

ipv4: Fix incorrect TOS in route get reply

2024-08-03 08:49:24 +02:00

ip_tunnels.h

net: tunnel: make skb_vlan_inet_prepare() return drop reasons

2026-02-19 16:25:21 +01:00

ip_vs.h

…

ip.h

ipv4: Convert ip_route_input() to dscp_t.

2025-03-07 16:56:44 +01:00

ipcomp.h

…

ipconfig.h

…

ipv6_frag.h

…

ipv6_stubs.h

bpf: Derive source IP addr via bpf_*_fib_lookup()

2024-03-06 14:45:20 +00:00

ipv6.h

ipv6: fix a race in ip6_sock_set_v6only()

2026-03-04 07:20:06 -05:00

iw_handler.h

…

kcm.h

kcm: Serialise kcm_sendmsg() for the same socket.

2024-08-29 17:30:44 +02:00

l3mdev.h

vrf: use RCU protection in l3mdev_l3_out()

2025-02-21 13:49:56 +01:00

lag.h

…

lapb.h

net: lapb: increase LAPB_HEADER_LEN

2024-12-19 18:08:53 +01:00

lib80211.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

llc: Drop support for ETH_P_TR_802_2.

2024-01-31 16:17:04 -08:00

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

lwtunnel.h

…

mac80211.h

wifi: mac80211: generate EMA beacons in AP mode

2026-01-11 15:18:59 +01:00

mac802154.h

…

macsec.h

macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads

2024-05-02 16:29:32 +02:00

mctp.h

mctp: Handle error of rtnl_register_module().

2024-10-17 15:22:23 +02:00

mctpdevice.h

…

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

…

mrp.h

…

ncsi.h

…

ndisc.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

neighbour.h

neighbour: add support for NUD_PERMANENT proxy entries

2025-08-28 16:25:57 +02:00

net_debug.h

…

net_failover.h

…

net_namespace.h

net: add dev_net_rcu() helper

2025-02-21 13:50:06 +01:00

net_ratelimit.h

…

net_trackers.h

…

netdev_queues.h

net: provide macros for commonly copied lockless queue stop/wake code

2024-11-01 01:56:04 +01:00

netevent.h

…

netlabel.h

…

netlink.h

netlink: split up copies in the ack construction

2023-10-10 22:00:44 +02:00

netprio_cgroup.h

…

netrom.h

…

nexthop.h

ipv6: remove nexthop_fib6_nh_bh()

2023-10-10 22:00:46 +02:00

nl802154.h

…

nsh.h

…

p8022.h

…

page_pool.h

…

pie.h

…

ping.h

…

pkt_cls.h

…

pkt_sched.h

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-12-07 06:12:09 +09:00

pptp.h

…

protocol.h

…

psample.h

…

psnap.h

…

raw.h

…

rawv6.h

…

red.h

…

regulatory.h

…

request_sock.h

…

rose.h

net: rose: convert 'use' field to refcount_t

2025-09-04 15:26:28 +02:00

route.h

ipv4: Drop tos parameter from flowi4_update_output()

2025-05-18 08:21:21 +02:00

rpl.h

…

rsi_91x.h

…

rtnetlink.h

rtnetlink: Add bulk registration helpers for rtnetlink message handlers.

2024-10-17 15:22:23 +02:00

rtnh.h

…

sch_generic.h

net_sched: Flush gso_skb list too during ->change()

2025-05-22 14:10:02 +02:00

scm.h

af_unix: Add dead flag to struct scm_fp_list.

2025-06-04 14:40:24 +02:00

secure_seq.h

…

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

selftests.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

…

sock.h

inet: Avoid ehash lookup race in inet_ehash_insert()

2026-01-11 15:18:19 +01:00

Space.h

…

stp.h

…

strparser.h

strparser: Add read_sock callback

2025-03-07 16:56:37 +01:00

switchdev.h

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:26:35 +01:00

tcp_states.h

…

tcp.h

bpf: Fix wrong copied_seq calculation

2025-03-07 16:56:37 +01:00

timewait_sock.h

…

tipc.h

…

tls_toe.h

…

tls.h

net: tls: Cancel RX async resync request on rcd_delta overflow

2025-12-07 06:12:39 +09:00

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO

2024-01-10 17:10:28 +01:00

udp.h

net: drop UFO packets in udp_rcv_segment()

2025-08-15 12:05:10 +02:00

udplite.h

…

vsock_addr.h

…

vxlan.h

…

wext.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

…

xdp_sock.h

xsk: Fix race condition in AF_XDP generic RX path

2026-02-19 16:25:19 +01:00

xdp.h

bpf: Clear pfmemalloc flag when freeing all fragments

2025-12-07 06:12:17 +09:00

xfrm.h

Revert "xfrm: destroy xfrm_state synchronously on net exit path"

2026-01-11 15:18:12 +01:00

xsk_buff_pool.h

xsk: Fix race condition in AF_XDP generic RX path

2026-02-19 16:25:19 +01:00