[PATCH net] ipv6: fix a race in ip6_sock_set_v6only()

[PATCH net] ipv6: fix a race in ip6_sock_set_v6only()

[Eric Dumazet]

It is unlikely that this function will be ever called
with isk->inet_num being not zero.

Perform the check on isk->inet_num inside the locked section
for complete safety.

Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 include/net/ipv6.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index cc56e09525d03b8e12dd92cec2751c2a13f16c10..53c5056508be543ae5d312e26dea6ed78fcc04ee 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1213,12 +1213,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
 
 static inline int ip6_sock_set_v6only(struct sock *sk)
 {
-	if (inet_sk(sk)->inet_num)
-		return -EINVAL;
+	int ret = 0;
+
 	lock_sock(sk);
-	sk->sk_ipv6only = true;
+	if (inet_sk(sk)->inet_num)
+		ret = -EINVAL;
+	else
+		sk->sk_ipv6only = true;
 	release_sock(sk);
-	return 0;
+	return ret;
 }
 
 static inline void ip6_sock_set_recverr(struct sock *sk)
-- 
2.53.0.310.g728cabbaf7-goog

Re: [PATCH net] ipv6: fix a race in ip6_sock_set_v6only()

[Simon Horman]

On Mon, Feb 16, 2026 at 10:22:02AM +0000, Eric Dumazet wrote:
> It is unlikely that this function will be ever called
> with isk->inet_num being not zero.
> 
> Perform the check on isk->inet_num inside the locked section
> for complete safety.
> 
> Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] ipv6: fix a race in ip6_sock_set_v6only()

[Fernando Fernandez Mancera]

On 2/16/26 11:22 AM, Eric Dumazet wrote:
> It is unlikely that this function will be ever called
> with isk->inet_num being not zero.
> 
> Perform the check on isk->inet_num inside the locked section
> for complete safety.
> 
> Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!

Re: [PATCH net] ipv6: fix a race in ip6_sock_set_v6only()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 16 Feb 2026 10:22:02 +0000 you wrote:
> It is unlikely that this function will be ever called
> with isk->inet_num being not zero.
> 
> Perform the check on isk->inet_num inside the locked section
> for complete safety.
> 
> Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> 
> [...]

Here is the summary with links:
  - [net] ipv6: fix a race in ip6_sock_set_v6only()
    https://git.kernel.org/netdev/net/c/452a3eee22c5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html