Re: [PATCH] ipv6: addrconf: drop "BUG: " prefix from pr_warn()

[AnishMulay <anishm7030@gmail.com>]

Hi Ido,

I ran into this same warning independently (different syzbot report,
address 2001::fb rather than fc00::, extid 57f410c9a4f8d7a441d6) and
ended up tracing it down before finding this thread.

The mechanism in my case: keep_addr_on_down is set, addrconf_ifdown()
clears ifp->rt and deletes the route for the kept address but skips
its notifier. On the following up, fixup_permanent_addr() allocates a
new fib6_info and schedules addrconf_dad_work asynchronously instead
of inserting the route itself. If a second addrconf_ifdown() for the
same device runs before that work item gets to execute (I see this
happen within a single "ip link set lo up" call, which drives both a
NETDEV_UP and a NETDEV_CHANGE through addrconf_notify()), the fresh
route gets torn down again with no notifier to re-arm anything. The
work item then runs with ifp->rt NULL and nothing left to insert.

I have a patch that regenerates the route at that point instead of
only warning, verified against a C reproducer translated from the
syzbot repro (no warning, and the /128 route is present after the
down/up cycle, across repeated runs). Since you mentioned you were
looking into avoiding this state, I wanted to check before sending it,
in case you already have something further along or a different angle
on it. Happy to send what I have either way.

Anish