[PATCH net-next] net: ipv4: clear dev->ip_ptr before destroying inetdev
From: Yuyang Huang <hidden>
Date: 2026-07-07 04:30:44
Also in:
lkml
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
To prevent RCU readers from accessing a partially destroyed in_device, clear dev->ip_ptr early in inetdev_destroy() before freeing the multicast list and individual IP addresses. This aligns the IPv4 teardown sequence with the IPv6 implementation. Cc: Ido Schimmel <idosch@nvidia.com> Cc: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Yuyang Huang <redacted> --- net/ipv4/devinet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a35b72662e43..3b31f4bec30e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c@@ -322,6 +322,8 @@ static void inetdev_destroy(struct in_device *in_dev) in_dev->dead = 1; + RCU_INIT_POINTER(dev->ip_ptr, NULL); + ip_mc_destroy_dev(in_dev); while ((ifa = rtnl_dereference(in_dev->ifa_list)) != NULL) {
@@ -329,8 +331,6 @@ static void inetdev_destroy(struct in_device *in_dev) inet_free_ifa(ifa); } - RCU_INIT_POINTER(dev->ip_ptr, NULL); - devinet_sysctl_unregister(in_dev); neigh_parms_release(&arp_tbl, in_dev->arp_parms); arp_ifdown(dev);
--
2.55.0.795.g602f6c329a-goog