Subject: Re: [PATCH net-next] ipv6: move IFA_F_PERMANENT percpu allocation in process scope

From: Jakub Kicinski <[email-masked]>
Date: Thu, 26 Mar 2026 18:35:59 -0700

On Tue, 24 Mar 2026 16:22:08 +0100 Paolo Abeni wrote:
> +	while (!list_empty(&tmp_addr_list)) {
> +		ifp = list_first_entry(&tmp_addr_list,
> +				       struct inet6_ifaddr, if_list_aux);
> +		list_del(&ifp->if_list_aux);
> +
> +		if (fixup_permanent_addr(net, idev, ifp) < 0) {
>  			in6_ifa_hold(ifp);
>  			ipv6_del_addr(ifp);
> -			write_lock_bh(&idev->lock);
>  
>  			net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
>  					     idev->dev->name, &ifp->addr);
>  		}

Sashiko points out that there's a UAF on the ifp->addr in the print
statement. Could you reorder these in net first, to avoid the conflict?
-- 
pw-bot: cr