Re: [net,v3] udp: revalidate socket family before publishing an IPv6 cork

[Kuniyuki Iwashima <kuniyu@google.com>]

From: Paolo Abeni <pabeni@redhat.com>
Date: Thu, 3 Sep 2026 15:22:57 +0200
> On 9/3/26 3:05 PM, netdev-bot+sashiko@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 2 potential
> > issue(s) to consider:
> > 
> > Critical: 0 · High: 2 · Medium: 0 · Low: 0
> > 
> > - [High] Incomplete fix: the sibling IPv6 socket-dst publisher in the
> >   connect() path is not covered, so an IPv6 dst can still be installed…
> > - [High] The fix is writer-side and after-the-fact, so the mixed-family
> >   socket dst it claims to eliminate remains observable by the unguarded…
> 
> It looks like fixing this kind of issues, if possible at all, would
> require adding a significant complexity to the data-path.
> 
> I'm wondering if we could just remove setsockopt(IPV6_ADDRFORM) support?

+1.

The feature was initially defined in RFC 2133 in 1997, but only
two years later, it was removed from RFC 2553 in 1999.

It's 2026 now, and I think most (all?) applications are ready to
be passed IPv6 socekt fd given systemd does not use IPV6_ADDRFORM.