ipv6: fix a race in ip6_sock_set_v6only()

It is unlikely that this function will be ever called
with isk->inet_num being not zero.

Perform the check on isk->inet_num inside the locked section
for complete safety.

Fixes: 9b115749ac ("ipv6: add ip6_sock_set_v6only")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260216102202.3343588-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2026-02-16 10:22:02 +00:00 committed by Jakub Kicinski
parent 77c5e3fdd2
commit 452a3eee22

View file

@ -1213,12 +1213,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
static inline int ip6_sock_set_v6only(struct sock *sk)
{
if (inet_sk(sk)->inet_num)
return -EINVAL;
int ret = 0;
lock_sock(sk);
sk->sk_ipv6only = true;
if (inet_sk(sk)->inet_num)
ret = -EINVAL;
else
sk->sk_ipv6only = true;
release_sock(sk);
return 0;
return ret;
}
static inline void ip6_sock_set_recverr(struct sock *sk)