ipv6: fix a race in ip6_sock_set_v6only()

It is unlikely that this function will be ever called
with isk->inet_num being not zero.

Perform the check on isk->inet_num inside the locked section
for complete safety.

Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260216102202.3343588-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index cc56e09525d03b8e12dd92cec2751c2a13f16c10..53c5056508be543ae5d312e26dea6ed78fcc04ee 100644 (file)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1213,12 +1213,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
 
 static inline int ip6_sock_set_v6only(struct sock *sk)
 {
-       if (inet_sk(sk)->inet_num)
-               return -EINVAL;
+       int ret = 0;
+
        lock_sock(sk);
-       sk->sk_ipv6only = true;
+       if (inet_sk(sk)->inet_num)
+               ret = -EINVAL;
+       else
+               sk->sk_ipv6only = true;
        release_sock(sk);
-       return 0;
+       return ret;
 }
 
 static inline void ip6_sock_set_recverr(struct sock *sk)