| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/01 20:28 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": [
"IPV6"
],
"FocusSymbols": [
"ipv6_sock_ac_join",
"ipv6_sock_ac_drop",
"ipv6_sock_mc_join",
"ipv6_sock_mc_drop",
"inet6_netconf_get_devconf",
"addrconf_prefix_rcv",
"ndisc_recv_ns"
],
"Reasoning": "The patch fixes a potential use-after-free or refcount underflow in the core IPv6 function `in6_dev_get` by using `refcount_inc_not_zero`. Since `in6_dev_get` is an inline function, we focus fuzzing on several key IPv6 functions that call it and are directly reachable from userspace (via setsockopt or netlink) or network packets (via neighbor discovery and router advertisements).",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/01 20:28 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit cb3dd5746bb1fc0d5779e3c70fa6d2e41ff8b428\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sat Aug 1 20:28:43 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/net/addrconf.h b/include/net/addrconf.h\nindex 8ced27a8229b6..e6764245995f2 100644\n--- a/include/net/addrconf.h\n+++ b/include/net/addrconf.h\n@@ -405,8 +405,8 @@ static inline struct inet6_dev *in6_dev_get(const struct net_device *dev)\n \n \trcu_read_lock();\n \tidev = rcu_dereference(dev-\u003eip6_ptr);\n-\tif (idev)\n-\t\trefcount_inc(\u0026idev-\u003erefcnt);\n+\tif (idev \u0026\u0026 !refcount_inc_not_zero(\u0026idev-\u003erefcnt))\n+\t\tidev = NULL;\n \trcu_read_unlock();\n \treturn idev;\n }\n"
} |
| 2/1 | 2026/08/01 20:28 | agent | patch-evaluator |
1mModel:best-expensive Args: null Results: {
"EnableConfigs": [
"IPV6"
],
"FocusSymbols": [
"ipv6_sock_ac_join",
"ipv6_sock_ac_drop",
"ipv6_sock_mc_join",
"ipv6_sock_mc_drop",
"inet6_netconf_get_devconf",
"addrconf_prefix_rcv",
"ndisc_recv_ns"
],
"Reasoning": "The patch fixes a potential use-after-free or refcount underflow in the core IPv6 function `in6_dev_get` by using `refcount_inc_not_zero`. Since `in6_dev_get` is an inline function, we focus fuzzing on several key IPv6 functions that call it and are directly reachable from userspace (via setsockopt or netlink) or network packets (via neighbor discovery and router advertisements).",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit cb3dd5746bb1fc0d5779e3c70fa6d2e41ff8b428
Author: syz-cluster <triage@syzkaller.com>
Date: Sat Aug 1 20:28:43 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 8ced27a8229b6..e6764245995f2 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -405,8 +405,8 @@ static inline struct inet6_dev *in6_dev_get(const struct net_device *dev)
rcu_read_lock();
idev = rcu_dereference(dev->ip6_ptr);
- if (idev)
- refcount_inc(&idev->refcnt);
+ if (idev && !refcount_inc_not_zero(&idev->refcnt))
+ idev = NULL;
rcu_read_unlock();
return idev;
}
|
| 3/2 | 2026/08/01 20:28 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2061 output: 20 thoughts: 215 Thoughts: **Analyzing the Impact of a Networking Patch** Okay, so I'm looking at this patch that tweaks `in6_dev_get` in `include/net/addrconf.h`. The change is pretty straightforward: it's replacing a simple `refcount_inc` with `refcount_inc_not_zero`. Sounds like a solid fix for a potential use-after-free or refcount underflow scenario if `idev->refcnt` happens to be zero. Pretty important to catch these kinds of race conditions in core networking components. Now, my initial thought is, "Where's this function called, and what are the implications?" It's an inline function, which means it's expanded in place. That makes targeted fuzzing by name a bit tricky. I can't just throw a fuzzer at `in6_dev_get` directly. I need to find its callers to identify meaningful fuzzing targets. I could look for functions that call it directly, or since it's an inline networking function I could just infer it's used in lots of core networking functions and I don't need to specify `FocusSymbols`. Or maybe I should dig in and try to find some specific callers to narrow down the focus of the testing. Ah, right, it's IPv6 networking. That helps narrow the scope a bit. Let me quickly scan through the code and figure out the call sites. |
| 4/2 | 2026/08/01 20:28 | tool | grepper |
0mArgs:{
"Expression": "in6_dev_get"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 895 lines.\nUse more precise expression if possible.\n\nDocumentation/networking/net_cachelines/net_device.rst=88=struct hlist_head fib_nh_head\nDocumentation/networking/net_cachelines/net_device.rst:89:struct inet6_dev* ip6_ptr read_mostly read_mostly __in6_dev_get\nDocumentation/networking/net_cachelines/net_device.rst-90-struct vlan_info* vlan_info\n--\ndrivers/infiniband/core/roce_gid_mgmt.c-37-\ndrivers/infiniband/core/roce_gid_mgmt.c:38:/* For in6_dev_get/in6_dev_put */\ndrivers/infiniband/core/roce_gid_mgmt.c-39-#include \u003cnet/addrconf.h\u003e\n--\ndrivers/infiniband/core/roce_gid_mgmt.c=375=static void enum_netdev_ipv6_ips(struct ib_device *ib_dev,\n--\ndrivers/infiniband/core/roce_gid_mgmt.c-391-\ndrivers/infiniband/core/roce_gid_mgmt.c:392:\tin6_dev = in6_dev_get(ndev);\ndrivers/infiniband/core/roce_gid_mgmt.c-393-\tif (!in6_dev)\n--\ndrivers/infiniband/hw/cxgb4/cm.c=3261=static int get_lladdr(struct net_device *dev, struct in6_addr *addr,\n--\ndrivers/infiniband/hw/cxgb4/cm.c-3267-\trcu_read_lock();\ndrivers/infiniband/hw/cxgb4/cm.c:3268:\tidev = __in6_dev_get(dev);\ndrivers/infiniband/hw/cxgb4/cm.c-3269-\tif (idev != NULL) {\n--\ndrivers/infiniband/hw/irdma/cm.c=1656=static int irdma_add_mqh_6(struct irdma_device *iwdev,\n--\ndrivers/infiniband/hw/irdma/cm.c-1676-\ndrivers/infiniband/hw/irdma/cm.c:1677:\t\tidev = __in6_dev_get(ip_dev);\ndrivers/infiniband/hw/irdma/cm.c-1678-\t\tif (!idev) {\n--\ndrivers/infiniband/hw/irdma/utils.c=336=static void irdma_add_ipv6_addr(struct irdma_device *iwdev)\n--\ndrivers/infiniband/hw/irdma/utils.c-348-\t\t (READ_ONCE(ip_dev-\u003eflags) \u0026 IFF_UP)) {\ndrivers/infiniband/hw/irdma/utils.c:349:\t\t\tidev = __in6_dev_get(ip_dev);\ndrivers/infiniband/hw/irdma/utils.c-350-\t\t\tif (!idev) {\n--\ndrivers/net/ethernet/chelsio/cxgb4/clip_tbl.c=196=static int cxgb4_update_dev_clip(struct net_device *root_dev,\n--\ndrivers/net/ethernet/chelsio/cxgb4/clip_tbl.c-202-\ndrivers/net/ethernet/chelsio/cxgb4/clip_tbl.c:203:\tidev = __in6_dev_get(root_dev);\ndrivers/net/ethernet/chelsio/cxgb4/clip_tbl.c-204-\tif (!idev)\n--\ndrivers/net/ethernet/mellanox/mlxsw/spectrum_router.c=8234=static bool __mlxsw_sp_dev_addr_list_empty(const struct net_device *dev)\n--\ndrivers/net/ethernet/mellanox/mlxsw/spectrum_router.c-8242-\ndrivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:8243:\tinet6_dev = __in6_dev_get(dev);\ndrivers/net/ethernet/mellanox/mlxsw/spectrum_router.c-8244-\tif (inet6_dev \u0026\u0026 !list_empty(\u0026inet6_dev-\u003eaddr_list))\n--\ndrivers/net/geneve.c=2339=static void geneve_link_config(struct net_device *dev,\n--\ndrivers/net/geneve.c-2364-\ndrivers/net/geneve.c:2365:\t\tif (!__in6_dev_get(dev))\ndrivers/net/geneve.c-2366-\t\t\tbreak;\n--\ndrivers/net/netconsole.c=393=static int netcons_take_ipv6(struct netconsole_target *nt,\n--\ndrivers/net/netconsole.c-406-\ndrivers/net/netconsole.c:407:\tidev = __in6_dev_get(ndev);\ndrivers/net/netconsole.c-408-\tif (idev) {\n--\ndrivers/net/usb/cdc_mbim.c=309=static void do_neigh_solicit(struct usbnet *dev, u8 *buf, u16 tci)\n--\ndrivers/net/usb/cdc_mbim.c-338-\ndrivers/net/usb/cdc_mbim.c:339:\tin6_dev = in6_dev_get(netdev);\ndrivers/net/usb/cdc_mbim.c-340-\tif (!in6_dev)\n--\ndrivers/net/vxlan/vxlan_core.c=3743=static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf,\n--\ndrivers/net/vxlan/vxlan_core.c-3845-\t\tif (use_ipv6) {\ndrivers/net/vxlan/vxlan_core.c:3846:\t\t\tstruct inet6_dev *idev = __in6_dev_get(lowerdev);\ndrivers/net/vxlan/vxlan_core.c-3847-\n--\ndrivers/net/wireguard/device.c=31=static int wg_open(struct net_device *dev)\n--\ndrivers/net/wireguard/device.c-33-\tstruct in_device *dev_v4 = __in_dev_get_rtnl(dev);\ndrivers/net/wireguard/device.c:34:\tstruct inet6_dev *dev_v6 = __in6_dev_get(dev);\ndrivers/net/wireguard/device.c-35-\tstruct wg_device *wg = netdev_priv(dev);\n--\ndrivers/net/wireless/ath/ath12k/wow.c=639=static void ath12k_wow_prepare_ns_offload(struct ath12k_link_vif *arvif,\n--\ndrivers/net/wireless/ath/ath12k/wow.c-651-\ndrivers/net/wireless/ath/ath12k/wow.c:652:\tidev = in6_dev_get(ndev);\ndrivers/net/wireless/ath/ath12k/wow.c-653-\tif (!idev)\n--\ndrivers/s390/net/qeth_l3_main.c=1051=static int qeth_l3_add_mcast_rtnl(struct net_device *dev, int vid, void *arg)\n--\ndrivers/s390/net/qeth_l3_main.c-1096-\ndrivers/s390/net/qeth_l3_main.c:1097:\tin6_dev = __in6_dev_get(dev);\ndrivers/s390/net/qeth_l3_main.c-1098-\tif (!in6_dev)\n--\nfs/smb/server/smb2pdu.c=8569=static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,\n--\nfs/smb/server/smb2pdu.c-8653-\nfs/smb/server/smb2pdu.c:8654:\t\t\tidev6 = __in6_dev_get(netdev);\nfs/smb/server/smb2pdu.c-8655-\t\t\tif (!idev6)\n--\ninclude/net/addrconf.h=336=void inet6_netconf_notify_devconf(struct net *net, int event, int type,\n--\ninclude/net/addrconf.h-339-/**\ninclude/net/addrconf.h:340: * __in6_dev_get - get inet6_dev pointer from netdevice\ninclude/net/addrconf.h-341- * @dev: network device\n--\ninclude/net/addrconf.h-345- */\ninclude/net/addrconf.h:346:static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)\ninclude/net/addrconf.h-347-{\n--\ninclude/net/addrconf.h=351=static inline struct inet6_dev *in6_dev_rcu(const struct net_device *dev)\n--\ninclude/net/addrconf.h-355-\ninclude/net/addrconf.h:356:static inline struct inet6_dev *__in6_dev_get_rtnl_net(const struct net_device *dev)\ninclude/net/addrconf.h-357-{\n--\ninclude/net/addrconf.h=369=static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,\n--\ninclude/net/addrconf.h-376-\t}\ninclude/net/addrconf.h:377:\treturn __in6_dev_get(dev);\ninclude/net/addrconf.h-378-}\n--\ninclude/net/addrconf.h-380-/**\ninclude/net/addrconf.h:381: * __in6_dev_get_safely - get inet6_dev pointer from netdevice\ninclude/net/addrconf.h-382- * @dev: network device\ninclude/net/addrconf.h-383- *\ninclude/net/addrconf.h:384: * This is a safer version of __in6_dev_get\ninclude/net/addrconf.h-385- */\ninclude/net/addrconf.h:386:static inline struct inet6_dev *__in6_dev_get_safely(const struct net_device *dev)\ninclude/net/addrconf.h-387-{\n--\ninclude/net/addrconf.h-394-/**\ninclude/net/addrconf.h:395: * in6_dev_get - get inet6_dev pointer from netdevice\ninclude/net/addrconf.h-396- * @dev: network device\n--\ninclude/net/addrconf.h-401- */\ninclude/net/addrconf.h:402:static inline struct inet6_dev *in6_dev_get(const struct net_device *dev)\ninclude/net/addrconf.h-403-{\n--\ninclude/net/addrconf.h=414=static inline struct neigh_parms *__in6_dev_nd_parms_get_rcu(const struct net_device *dev)\ninclude/net/addrconf.h-415-{\ninclude/net/addrconf.h:416:\tstruct inet6_dev *idev = __in6_dev_get(dev);\ninclude/net/addrconf.h-417-\n--\ninclude/net/addrconf.h=455=static inline bool ip6_ignore_linkdown(const struct net_device *dev)\ninclude/net/addrconf.h-456-{\ninclude/net/addrconf.h:457:\tconst struct inet6_dev *idev = __in6_dev_get(dev);\ninclude/net/addrconf.h-458-\n--\ninclude/net/ip6_route.h=365=static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst,\n--\ninclude/net/ip6_route.h-378-\trcu_read_lock();\ninclude/net/ip6_route.h:379:\tidev = __in6_dev_get(dst_dev_rcu(dst));\ninclude/net/ip6_route.h-380-\tif (idev)\n--\ninclude/net/ipv6_frag.h=65=ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)\n--\ninclude/net/ipv6_frag.h-89-\ninclude/net/ipv6_frag.h:90:\t__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);\ninclude/net/ipv6_frag.h:91:\t__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);\ninclude/net/ipv6_frag.h-92-\n--\ninclude/net/netfilter/nf_tables_ipv6.h=75=static inline int nft_set_pktinfo_ipv6_ingress(struct nft_pktinfo *pkt)\n--\ninclude/net/netfilter/nf_tables_ipv6.h-94-\tif (pkt_len + sizeof(*ip6h) \u003e pkt-\u003eskb-\u003elen) {\ninclude/net/netfilter/nf_tables_ipv6.h:95:\t\tidev = __in6_dev_get(nft_in(pkt));\ninclude/net/netfilter/nf_tables_ipv6.h-96-\t\t__IP6_INC_STATS(nft_net(pkt), idev, IPSTATS_MIB_INTRUNCATEDPKTS);\n--\ninclude/net/netfilter/nf_tables_ipv6.h-113-inhdr_error:\ninclude/net/netfilter/nf_tables_ipv6.h:114:\tidev = __in6_dev_get(nft_in(pkt));\ninclude/net/netfilter/nf_tables_ipv6.h-115-\t__IP6_INC_STATS(nft_net(pkt), idev, IPSTATS_MIB_INHDRERRORS);\n--\nnet/6lowpan/core.c=108=static int lowpan_event(struct notifier_block *unused,\n--\nnet/6lowpan/core.c-118-\nnet/6lowpan/core.c:119:\tidev = __in6_dev_get(dev);\nnet/6lowpan/core.c-120-\tif (!idev)\n--\nnet/batman-adv/multicast.c=132=static u8 batadv_mcast_mla_rtr_flags_meshif_get_ipv6(struct net_device *dev)\nnet/batman-adv/multicast.c-133-{\nnet/batman-adv/multicast.c:134:\tstruct inet6_dev *in6_dev = __in6_dev_get(dev);\nnet/batman-adv/multicast.c-135-\n--\nnet/batman-adv/multicast.c=433=batadv_mcast_mla_meshif_get_ipv6(struct net_device *dev,\n--\nnet/batman-adv/multicast.c-447-\nnet/batman-adv/multicast.c:448:\tin6_dev = __in6_dev_get(dev);\nnet/batman-adv/multicast.c-449-\tif (!in6_dev) {\n--\nnet/bridge/br_netfilter_ipv6.c=44=int br_validate_ipv6(struct net *net, struct sk_buff *skb)\n--\nnet/bridge/br_netfilter_ipv6.c-46-\tconst struct ipv6hdr *hdr;\nnet/bridge/br_netfilter_ipv6.c:47:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/bridge/br_netfilter_ipv6.c-48-\tu32 pkt_len;\n--\nnet/core/filter.c=6360=static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,\n--\nnet/core/filter.c-6381-\nnet/core/filter.c:6382:\tidev = __in6_dev_get_safely(dev);\nnet/core/filter.c-6383-\tif (unlikely(!idev || !READ_ONCE(idev-\u003ecnf.forwarding)))\n--\nnet/core/pktgen.c=2195=static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)\n--\nnet/core/pktgen.c-2255-\t\t\trcu_read_lock();\nnet/core/pktgen.c:2256:\t\t\tidev = __in6_dev_get(pkt_dev-\u003eodev);\nnet/core/pktgen.c-2257-\t\t\tif (idev) {\n--\nnet/ipv4/icmp.c=1291=bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)\n--\nnet/ipv4/icmp.c-1385-\nnet/ipv4/icmp.c:1386:\tin6_dev = __in6_dev_get(dev);\nnet/ipv4/icmp.c-1387-\tif (in6_dev \u0026\u0026 !list_empty(\u0026in6_dev-\u003eaddr_list))\n--\nnet/ipv6/addrconf.c=490=static struct inet6_dev *ipv6_find_idev(struct net_device *dev)\n--\nnet/ipv6/addrconf.c-495-\nnet/ipv6/addrconf.c:496:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-497-\tif (!idev) {\n--\nnet/ipv6/addrconf.c=657=static int inet6_netconf_get_devconf(struct sk_buff *in_skb,\n--\nnet/ipv6/addrconf.c-689-\t\t\treturn -EINVAL;\nnet/ipv6/addrconf.c:690:\t\tin6_dev = in6_dev_get(dev);\nnet/ipv6/addrconf.c-691-\t\tif (!in6_dev)\n--\nnet/ipv6/addrconf.c=735=static int inet6_netconf_dump_devconf(struct sk_buff *skb,\n--\nnet/ipv6/addrconf.c-764-\tfor_each_netdev_dump(net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:765:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-766-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=853=static void addrconf_forward_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-858-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:859:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-860-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=919=static void addrconf_linkdown_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-924-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:925:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-926-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=1800=static int ipv6_get_saddr_master(struct net *net,\n--\nnet/ipv6/addrconf.c-1808-\nnet/ipv6/addrconf.c:1809:\tidev = __in6_dev_get(dst_dev);\nnet/ipv6/addrconf.c-1810-\tif (idev)\n--\nnet/ipv6/addrconf.c-1813-\nnet/ipv6/addrconf.c:1814:\tidev = __in6_dev_get(master);\nnet/ipv6/addrconf.c-1815-\tif (idev)\n--\nnet/ipv6/addrconf.c=1822=int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,\n--\nnet/ipv6/addrconf.c-1863-\tif (dst_dev) {\nnet/ipv6/addrconf.c:1864:\t\tidev = __in6_dev_get(dst_dev);\nnet/ipv6/addrconf.c-1865-\t\tif ((dst_type \u0026 IPV6_ADDR_MULTICAST) ||\n--\nnet/ipv6/addrconf.c-1901-\t\t\t\tcontinue;\nnet/ipv6/addrconf.c:1902:\t\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-1903-\t\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=1940=int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,\n--\nnet/ipv6/addrconf.c-1946-\trcu_read_lock();\nnet/ipv6/addrconf.c:1947:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-1948-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2040=bool ipv6_chk_custom_prefix(const struct in6_addr *addr,\n--\nnet/ipv6/addrconf.c-2047-\trcu_read_lock();\nnet/ipv6/addrconf.c:2048:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-2049-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2062=int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)\n--\nnet/ipv6/addrconf.c-2069-\trcu_read_lock();\nnet/ipv6/addrconf.c:2070:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-2071-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2798=void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)\n--\nnet/ipv6/addrconf.c-2833-\nnet/ipv6/addrconf.c:2834:\tin6_dev = in6_dev_get(dev);\nnet/ipv6/addrconf.c-2835-\n--\nnet/ipv6/addrconf.c=3106=static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,\n--\nnet/ipv6/addrconf.c-3124-\nnet/ipv6/addrconf.c:3125:\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-3126-\tif (!idev) {\n--\nnet/ipv6/addrconf.c=3482=static void addrconf_dev_config(struct net_device *dev)\n--\nnet/ipv6/addrconf.c-3499-\t\t/* Alas, we support only Ethernet autoconfiguration. */\nnet/ipv6/addrconf.c:3500:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3501-\t\tif (!IS_ERR_OR_NULL(idev) \u0026\u0026 dev-\u003eflags \u0026 IFF_UP \u0026\u0026\n--\nnet/ipv6/addrconf.c=3637=static void addrconf_permanent_addr(struct net *net, struct net_device *dev)\n--\nnet/ipv6/addrconf.c-3645-\nnet/ipv6/addrconf.c:3646:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3647-\tif (!idev)\n--\nnet/ipv6/addrconf.c=3671=static int addrconf_notify(struct notifier_block *this, unsigned long event,\n--\nnet/ipv6/addrconf.c-3676-\tstruct netdev_notifier_changeupper_info *info;\nnet/ipv6/addrconf.c:3677:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3678-\tstruct net *net = dev_net(dev);\n--\nnet/ipv6/addrconf.c=3856=static void addrconf_type_change(struct net_device *dev, unsigned long event)\n--\nnet/ipv6/addrconf.c-3860-\nnet/ipv6/addrconf.c:3861:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3862-\n--\nnet/ipv6/addrconf.c=3875=static int addrconf_ifdown(struct net_device *dev, bool unregister)\n--\nnet/ipv6/addrconf.c-3889-\nnet/ipv6/addrconf.c:3890:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3891-\tif (!idev)\n--\nnet/ipv6/addrconf.c=5430=static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,\n--\nnet/ipv6/addrconf.c-5464-\t\t\t}\nnet/ipv6/addrconf.c:5465:\t\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5466-\t\t\tif (idev)\n--\nnet/ipv6/addrconf.c-5475-\tfor_each_netdev_dump(tgt_net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:5476:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5477-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=5900=static size_t inet6_get_link_af_size(const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-5902-{\nnet/ipv6/addrconf.c:5903:\tif (!__in6_dev_get(dev))\nnet/ipv6/addrconf.c-5904-\t\treturn 0;\n--\nnet/ipv6/addrconf.c=5909=static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-5911-{\nnet/ipv6/addrconf.c:5912:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5913-\n--\nnet/ipv6/addrconf.c=6035=static int inet6_validate_link_af(const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-6043-\tif (dev) {\nnet/ipv6/addrconf.c:6044:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6045-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=6069=static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla,\n--\nnet/ipv6/addrconf.c-6071-{\nnet/ipv6/addrconf.c:6072:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6073-\tstruct nlattr *tb[IFLA_INET6_MAX + 1];\n--\nnet/ipv6/addrconf.c=6171=static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)\n--\nnet/ipv6/addrconf.c-6193-\tfor_each_netdev_dump(net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:6194:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6195-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=6415=static void addrconf_disable_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-6420-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6421:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6422-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=6524=static int addrconf_sysctl_addr_gen_mode(const struct ctl_table *ctl, int write,\n--\nnet/ipv6/addrconf.c-6569-\t\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6570:\t\t\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6571-\t\t\t\tif (idev \u0026\u0026\n--\nnet/ipv6/addrconf.c=6591=static int addrconf_sysctl_stable_secret(const struct ctl_table *ctl, int write,\n--\nnet/ipv6/addrconf.c-6637-\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6638:\t\t\tstruct inet6_dev *idev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6639-\n--\nnet/ipv6/addrconf.c=6726=int addrconf_disable_policy(const struct ctl_table *ctl, int *valp, int val)\n--\nnet/ipv6/addrconf.c-6744-\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6745:\t\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6746-\t\t\tif (idev)\n--\nnet/ipv6/addrconf.c=6778=static void addrconf_force_forward_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-6783-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6784:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6785-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=7625=void addrconf_cleanup(void)\n--\nnet/ipv6/addrconf.c-7638-\tfor_each_netdev(\u0026init_net, dev) {\nnet/ipv6/addrconf.c:7639:\t\tif (!__in6_dev_get_rtnl_net(dev))\nnet/ipv6/addrconf.c-7640-\t\t\tcontinue;\n--\nnet/ipv6/anycast.c=67=int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)\n--\nnet/ipv6/anycast.c-126-\nnet/ipv6/anycast.c:127:\tidev = in6_dev_get(dev);\nnet/ipv6/anycast.c-128-\tif (!idev) {\n--\nnet/ipv6/anycast.c=430=static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)\nnet/ipv6/anycast.c-431-{\nnet/ipv6/anycast.c:432:\tstruct inet6_dev *idev = in6_dev_get(dev);\nnet/ipv6/anycast.c-433-\tint err;\n--\nnet/ipv6/anycast.c=470=static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)\n--\nnet/ipv6/anycast.c-474-\nnet/ipv6/anycast.c:475:\tidev = __in6_dev_get(dev);\nnet/ipv6/anycast.c-476-\tif (idev) {\n--\nnet/ipv6/anycast.c=537=static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)\n--\nnet/ipv6/anycast.c-545-\nnet/ipv6/anycast.c:546:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/anycast.c-547-\t\tif (!idev)\n--\nnet/ipv6/anycast.c=556=static struct ifacaddr6 *ac6_get_next(struct seq_file *seq, struct ifacaddr6 *im)\n--\nnet/ipv6/anycast.c-565-\t\t\tbreak;\nnet/ipv6/anycast.c:566:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/anycast.c-567-\t\tif (!idev)\n--\nnet/ipv6/exthdrs.c=296=static int ipv6_destopt_rcv(struct sk_buff *skb)\nnet/ipv6/exthdrs.c-297-{\nnet/ipv6/exthdrs.c:298:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-299-\tstruct inet6_skb_parm *opt = IP6CB(skb);\n--\nnet/ipv6/exthdrs.c=371=static int ipv6_srh_rcv(struct sk_buff *skb)\n--\nnet/ipv6/exthdrs.c-381-\nnet/ipv6/exthdrs.c:382:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-383-\tif (!idev) {\n--\nnet/ipv6/exthdrs.c=488=static int ipv6_rpl_srh_rcv(struct sk_buff *skb)\n--\nnet/ipv6/exthdrs.c-501-\nnet/ipv6/exthdrs.c:502:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-503-\n--\nnet/ipv6/exthdrs.c=655=static int ipv6_rthdr_rcv(struct sk_buff *skb)\nnet/ipv6/exthdrs.c-656-{\nnet/ipv6/exthdrs.c:657:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-658-\tstruct inet6_skb_parm *opt = IP6CB(skb);\n--\nnet/ipv6/exthdrs.c=912=static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)\n--\nnet/ipv6/exthdrs.c-926-\t/* Does the device still have IPv6 configuration? */\nnet/ipv6/exthdrs.c:927:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-928-\tif (!idev) {\n--\nnet/ipv6/icmp.c=479=static struct in6_addr *icmp6_ext_iio_addr6_find(const struct net_device *dev)\n--\nnet/ipv6/icmp.c-483-\nnet/ipv6/icmp.c:484:\tin6_dev = __in6_dev_get(dev);\nnet/ipv6/icmp.c-485-\tif (!in6_dev)\n--\nnet/ipv6/icmp.c=636=void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,\n--\nnet/ipv6/icmp.c-815-\nnet/ipv6/icmp.c:816:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/icmp.c-817-\n--\nnet/ipv6/icmp.c=921=static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)\n--\nnet/ipv6/icmp.c-1001-\nnet/ipv6/icmp.c:1002:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/icmp.c-1003-\n--\nnet/ipv6/icmp.c=1037=enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type,\n--\nnet/ipv6/icmp.c-1092-out:\nnet/ipv6/icmp.c:1093:\t__ICMP6_INC_STATS(net, __in6_dev_get(skb-\u003edev), ICMP6_MIB_INERRORS);\nnet/ipv6/icmp.c-1094-\treturn reason;\n--\nnet/ipv6/icmp.c=1101=static int icmpv6_rcv(struct sk_buff *skb)\n--\nnet/ipv6/icmp.c-1105-\tstruct net_device *dev = icmp6_dev(skb);\nnet/ipv6/icmp.c:1106:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/icmp.c-1107-\tstruct icmp6hdr *hdr;\n--\nnet/ipv6/ioam6.c=707=static void __ioam6_fill_trace_data(struct sk_buff *skb,\n--\nnet/ipv6/ioam6.c-725-\nnet/ipv6/ioam6.c:726:\ti_skb_dev = skb-\u003edev ? __in6_dev_get(skb-\u003edev) : NULL;\nnet/ipv6/ioam6.c:727:\tidev = __in6_dev_get(dev);\nnet/ipv6/ioam6.c-728-\n--\nnet/ipv6/ip6_input.c=188=static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,\n--\nnet/ipv6/ip6_input.c-203-\nnet/ipv6/ip6_input.c:204:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ip6_input.c-205-\n--\nnet/ipv6/ip6_input.c=554=int ip6_mc_input(struct sk_buff *skb)\n--\nnet/ipv6/ip6_input.c-561-\t__IP6_UPD_PO_STATS(skb_dst_dev_net_rcu(skb),\nnet/ipv6/ip6_input.c:562:\t\t\t __in6_dev_get_safely(dev), IPSTATS_MIB_INMCAST,\nnet/ipv6/ip6_input.c-563-\t\t\t skb-\u003elen);\n--\nnet/ipv6/ip6_output.c=262=int ip6_dst_hoplimit(struct dst_entry *dst)\n--\nnet/ipv6/ip6_output.c-270-\n\n"
} |
| 5/2 | 2026/08/01 20:28 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 12984 output: 31 thoughts: 357 Thoughts: **Analyzing a Potential IPv6 Refcount Vulnerability** Okay, so this patch is interesting. It looks like they've modified `in6_dev_get` to address a potential use-after-free or, more precisely, a refcount underflow issue. The change is subtle but significant; instead of a simple increment, the code now checks if `idev->refcnt` is already zero before attempting to increment it. This makes sense – a zero refcount indicates the object is likely gone, so incrementing it would be a problem. The implications are clear: a race condition where the object is freed before `in6_dev_get` can increment its refcount. This is precisely the kind of issue that's ripe for fuzzing. Given the prevalence of `in6_dev_get`, which is called from numerous locations, I need to focus my efforts. I've got to find the most likely candidates to trigger this. The call sites are listed, and a quick glance suggests focusing on `net/ipv6/addrconf.c` and `net/ipv6/anycast.c`. Specifically, functions like `inet6_netconf_get_devconf` and `addrconf_prefix_rcv` within `addrconf.c`, and functions like `ipv6_sock_ac_join` and `ipv6_dev_ac_dec` in `anycast.c`. These seem like good starting points since they deal directly with network configuration and address management – complex areas where timing and resource management issues are common. It's time to dig into those and craft some targeted fuzzing campaigns. |
| 6/2 | 2026/08/01 20:28 | tool | grepper |
0mArgs:{
"Expression": "in6_dev_get",
"PathPrefix": "net/ipv6/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 648 lines.\nUse more precise expression if possible.\n\nnet/ipv6/addrconf.c=490=static struct inet6_dev *ipv6_find_idev(struct net_device *dev)\n--\nnet/ipv6/addrconf.c-495-\nnet/ipv6/addrconf.c:496:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-497-\tif (!idev) {\n--\nnet/ipv6/addrconf.c=657=static int inet6_netconf_get_devconf(struct sk_buff *in_skb,\n--\nnet/ipv6/addrconf.c-689-\t\t\treturn -EINVAL;\nnet/ipv6/addrconf.c:690:\t\tin6_dev = in6_dev_get(dev);\nnet/ipv6/addrconf.c-691-\t\tif (!in6_dev)\n--\nnet/ipv6/addrconf.c=735=static int inet6_netconf_dump_devconf(struct sk_buff *skb,\n--\nnet/ipv6/addrconf.c-764-\tfor_each_netdev_dump(net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:765:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-766-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=853=static void addrconf_forward_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-858-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:859:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-860-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=919=static void addrconf_linkdown_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-924-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:925:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-926-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=1800=static int ipv6_get_saddr_master(struct net *net,\n--\nnet/ipv6/addrconf.c-1808-\nnet/ipv6/addrconf.c:1809:\tidev = __in6_dev_get(dst_dev);\nnet/ipv6/addrconf.c-1810-\tif (idev)\n--\nnet/ipv6/addrconf.c-1813-\nnet/ipv6/addrconf.c:1814:\tidev = __in6_dev_get(master);\nnet/ipv6/addrconf.c-1815-\tif (idev)\n--\nnet/ipv6/addrconf.c=1822=int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,\n--\nnet/ipv6/addrconf.c-1863-\tif (dst_dev) {\nnet/ipv6/addrconf.c:1864:\t\tidev = __in6_dev_get(dst_dev);\nnet/ipv6/addrconf.c-1865-\t\tif ((dst_type \u0026 IPV6_ADDR_MULTICAST) ||\n--\nnet/ipv6/addrconf.c-1901-\t\t\t\tcontinue;\nnet/ipv6/addrconf.c:1902:\t\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-1903-\t\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=1940=int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,\n--\nnet/ipv6/addrconf.c-1946-\trcu_read_lock();\nnet/ipv6/addrconf.c:1947:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-1948-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2040=bool ipv6_chk_custom_prefix(const struct in6_addr *addr,\n--\nnet/ipv6/addrconf.c-2047-\trcu_read_lock();\nnet/ipv6/addrconf.c:2048:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-2049-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2062=int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)\n--\nnet/ipv6/addrconf.c-2069-\trcu_read_lock();\nnet/ipv6/addrconf.c:2070:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-2071-\tif (idev) {\n--\nnet/ipv6/addrconf.c=2798=void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)\n--\nnet/ipv6/addrconf.c-2833-\nnet/ipv6/addrconf.c:2834:\tin6_dev = in6_dev_get(dev);\nnet/ipv6/addrconf.c-2835-\n--\nnet/ipv6/addrconf.c=3106=static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,\n--\nnet/ipv6/addrconf.c-3124-\nnet/ipv6/addrconf.c:3125:\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-3126-\tif (!idev) {\n--\nnet/ipv6/addrconf.c=3482=static void addrconf_dev_config(struct net_device *dev)\n--\nnet/ipv6/addrconf.c-3499-\t\t/* Alas, we support only Ethernet autoconfiguration. */\nnet/ipv6/addrconf.c:3500:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3501-\t\tif (!IS_ERR_OR_NULL(idev) \u0026\u0026 dev-\u003eflags \u0026 IFF_UP \u0026\u0026\n--\nnet/ipv6/addrconf.c=3637=static void addrconf_permanent_addr(struct net *net, struct net_device *dev)\n--\nnet/ipv6/addrconf.c-3645-\nnet/ipv6/addrconf.c:3646:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3647-\tif (!idev)\n--\nnet/ipv6/addrconf.c=3671=static int addrconf_notify(struct notifier_block *this, unsigned long event,\n--\nnet/ipv6/addrconf.c-3676-\tstruct netdev_notifier_changeupper_info *info;\nnet/ipv6/addrconf.c:3677:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3678-\tstruct net *net = dev_net(dev);\n--\nnet/ipv6/addrconf.c=3856=static void addrconf_type_change(struct net_device *dev, unsigned long event)\n--\nnet/ipv6/addrconf.c-3860-\nnet/ipv6/addrconf.c:3861:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3862-\n--\nnet/ipv6/addrconf.c=3875=static int addrconf_ifdown(struct net_device *dev, bool unregister)\n--\nnet/ipv6/addrconf.c-3889-\nnet/ipv6/addrconf.c:3890:\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-3891-\tif (!idev)\n--\nnet/ipv6/addrconf.c=5430=static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,\n--\nnet/ipv6/addrconf.c-5464-\t\t\t}\nnet/ipv6/addrconf.c:5465:\t\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5466-\t\t\tif (idev)\n--\nnet/ipv6/addrconf.c-5475-\tfor_each_netdev_dump(tgt_net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:5476:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5477-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=5900=static size_t inet6_get_link_af_size(const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-5902-{\nnet/ipv6/addrconf.c:5903:\tif (!__in6_dev_get(dev))\nnet/ipv6/addrconf.c-5904-\t\treturn 0;\n--\nnet/ipv6/addrconf.c=5909=static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-5911-{\nnet/ipv6/addrconf.c:5912:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-5913-\n--\nnet/ipv6/addrconf.c=6035=static int inet6_validate_link_af(const struct net_device *dev,\n--\nnet/ipv6/addrconf.c-6043-\tif (dev) {\nnet/ipv6/addrconf.c:6044:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6045-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=6069=static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla,\n--\nnet/ipv6/addrconf.c-6071-{\nnet/ipv6/addrconf.c:6072:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6073-\tstruct nlattr *tb[IFLA_INET6_MAX + 1];\n--\nnet/ipv6/addrconf.c=6171=static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)\n--\nnet/ipv6/addrconf.c-6193-\tfor_each_netdev_dump(net, dev, ctx-\u003eifindex) {\nnet/ipv6/addrconf.c:6194:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/addrconf.c-6195-\t\tif (!idev)\n--\nnet/ipv6/addrconf.c=6415=static void addrconf_disable_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-6420-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6421:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6422-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=6524=static int addrconf_sysctl_addr_gen_mode(const struct ctl_table *ctl, int write,\n--\nnet/ipv6/addrconf.c-6569-\t\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6570:\t\t\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6571-\t\t\t\tif (idev \u0026\u0026\n--\nnet/ipv6/addrconf.c=6591=static int addrconf_sysctl_stable_secret(const struct ctl_table *ctl, int write,\n--\nnet/ipv6/addrconf.c-6637-\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6638:\t\t\tstruct inet6_dev *idev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6639-\n--\nnet/ipv6/addrconf.c=6726=int addrconf_disable_policy(const struct ctl_table *ctl, int *valp, int val)\n--\nnet/ipv6/addrconf.c-6744-\t\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6745:\t\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6746-\t\t\tif (idev)\n--\nnet/ipv6/addrconf.c=6778=static void addrconf_force_forward_change(struct net *net, __s32 newf)\n--\nnet/ipv6/addrconf.c-6783-\tfor_each_netdev(net, dev) {\nnet/ipv6/addrconf.c:6784:\t\tidev = __in6_dev_get_rtnl_net(dev);\nnet/ipv6/addrconf.c-6785-\t\tif (idev) {\n--\nnet/ipv6/addrconf.c=7625=void addrconf_cleanup(void)\n--\nnet/ipv6/addrconf.c-7638-\tfor_each_netdev(\u0026init_net, dev) {\nnet/ipv6/addrconf.c:7639:\t\tif (!__in6_dev_get_rtnl_net(dev))\nnet/ipv6/addrconf.c-7640-\t\t\tcontinue;\n--\nnet/ipv6/anycast.c=67=int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)\n--\nnet/ipv6/anycast.c-126-\nnet/ipv6/anycast.c:127:\tidev = in6_dev_get(dev);\nnet/ipv6/anycast.c-128-\tif (!idev) {\n--\nnet/ipv6/anycast.c=430=static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)\nnet/ipv6/anycast.c-431-{\nnet/ipv6/anycast.c:432:\tstruct inet6_dev *idev = in6_dev_get(dev);\nnet/ipv6/anycast.c-433-\tint err;\n--\nnet/ipv6/anycast.c=470=static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)\n--\nnet/ipv6/anycast.c-474-\nnet/ipv6/anycast.c:475:\tidev = __in6_dev_get(dev);\nnet/ipv6/anycast.c-476-\tif (idev) {\n--\nnet/ipv6/anycast.c=537=static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)\n--\nnet/ipv6/anycast.c-545-\nnet/ipv6/anycast.c:546:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/anycast.c-547-\t\tif (!idev)\n--\nnet/ipv6/anycast.c=556=static struct ifacaddr6 *ac6_get_next(struct seq_file *seq, struct ifacaddr6 *im)\n--\nnet/ipv6/anycast.c-565-\t\t\tbreak;\nnet/ipv6/anycast.c:566:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/anycast.c-567-\t\tif (!idev)\n--\nnet/ipv6/exthdrs.c=296=static int ipv6_destopt_rcv(struct sk_buff *skb)\nnet/ipv6/exthdrs.c-297-{\nnet/ipv6/exthdrs.c:298:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-299-\tstruct inet6_skb_parm *opt = IP6CB(skb);\n--\nnet/ipv6/exthdrs.c=371=static int ipv6_srh_rcv(struct sk_buff *skb)\n--\nnet/ipv6/exthdrs.c-381-\nnet/ipv6/exthdrs.c:382:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-383-\tif (!idev) {\n--\nnet/ipv6/exthdrs.c=488=static int ipv6_rpl_srh_rcv(struct sk_buff *skb)\n--\nnet/ipv6/exthdrs.c-501-\nnet/ipv6/exthdrs.c:502:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-503-\n--\nnet/ipv6/exthdrs.c=655=static int ipv6_rthdr_rcv(struct sk_buff *skb)\nnet/ipv6/exthdrs.c-656-{\nnet/ipv6/exthdrs.c:657:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-658-\tstruct inet6_skb_parm *opt = IP6CB(skb);\n--\nnet/ipv6/exthdrs.c=912=static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)\n--\nnet/ipv6/exthdrs.c-926-\t/* Does the device still have IPv6 configuration? */\nnet/ipv6/exthdrs.c:927:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/exthdrs.c-928-\tif (!idev) {\n--\nnet/ipv6/icmp.c=479=static struct in6_addr *icmp6_ext_iio_addr6_find(const struct net_device *dev)\n--\nnet/ipv6/icmp.c-483-\nnet/ipv6/icmp.c:484:\tin6_dev = __in6_dev_get(dev);\nnet/ipv6/icmp.c-485-\tif (!in6_dev)\n--\nnet/ipv6/icmp.c=636=void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,\n--\nnet/ipv6/icmp.c-815-\nnet/ipv6/icmp.c:816:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/icmp.c-817-\n--\nnet/ipv6/icmp.c=921=static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)\n--\nnet/ipv6/icmp.c-1001-\nnet/ipv6/icmp.c:1002:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/icmp.c-1003-\n--\nnet/ipv6/icmp.c=1037=enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type,\n--\nnet/ipv6/icmp.c-1092-out:\nnet/ipv6/icmp.c:1093:\t__ICMP6_INC_STATS(net, __in6_dev_get(skb-\u003edev), ICMP6_MIB_INERRORS);\nnet/ipv6/icmp.c-1094-\treturn reason;\n--\nnet/ipv6/icmp.c=1101=static int icmpv6_rcv(struct sk_buff *skb)\n--\nnet/ipv6/icmp.c-1105-\tstruct net_device *dev = icmp6_dev(skb);\nnet/ipv6/icmp.c:1106:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/icmp.c-1107-\tstruct icmp6hdr *hdr;\n--\nnet/ipv6/ioam6.c=707=static void __ioam6_fill_trace_data(struct sk_buff *skb,\n--\nnet/ipv6/ioam6.c-725-\nnet/ipv6/ioam6.c:726:\ti_skb_dev = skb-\u003edev ? __in6_dev_get(skb-\u003edev) : NULL;\nnet/ipv6/ioam6.c:727:\tidev = __in6_dev_get(dev);\nnet/ipv6/ioam6.c-728-\n--\nnet/ipv6/ip6_input.c=188=static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,\n--\nnet/ipv6/ip6_input.c-203-\nnet/ipv6/ip6_input.c:204:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ip6_input.c-205-\n--\nnet/ipv6/ip6_input.c=554=int ip6_mc_input(struct sk_buff *skb)\n--\nnet/ipv6/ip6_input.c-561-\t__IP6_UPD_PO_STATS(skb_dst_dev_net_rcu(skb),\nnet/ipv6/ip6_input.c:562:\t\t\t __in6_dev_get_safely(dev), IPSTATS_MIB_INMCAST,\nnet/ipv6/ip6_input.c-563-\t\t\t skb-\u003elen);\n--\nnet/ipv6/ip6_output.c=262=int ip6_dst_hoplimit(struct dst_entry *dst)\n--\nnet/ipv6/ip6_output.c-270-\nnet/ipv6/ip6_output.c:271:\t\tidev = __in6_dev_get(dev);\nnet/ipv6/ip6_output.c-272-\t\tif (idev)\n--\nnet/ipv6/ip6_output.c=519=int ip6_forward(struct sk_buff *skb)\n--\nnet/ipv6/ip6_output.c-529-\nnet/ipv6/ip6_output.c:530:\tidev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)-\u003eiif));\nnet/ipv6/ip6_output.c-531-\tif (!READ_ONCE(net-\u003eipv6.devconf_all-\u003eforwarding) \u0026\u0026\n--\nnet/ipv6/ip6mr.c=742=static int mif6_delete(struct mr_table *mrt, int vifi, int notify,\n--\nnet/ipv6/ip6mr.c-783-\nnet/ipv6/ip6mr.c:784:\tin6_dev = __in6_dev_get(dev);\nnet/ipv6/ip6mr.c-785-\tif (in6_dev) {\n--\nnet/ipv6/ip6mr.c=906=static int mif6_add(struct net *net, struct mr_table *mrt,\n--\nnet/ipv6/ip6mr.c-952-\nnet/ipv6/ip6mr.c:953:\tin6_dev = __in6_dev_get(dev);\nnet/ipv6/ip6mr.c-954-\tif (in6_dev) {\n--\nnet/ipv6/mcast.c=264=static void __ipv6_sock_mc_drop(struct sock *sk, struct ipv6_mc_socklist *mc_lst)\n--\nnet/ipv6/mcast.c-270-\tif (dev) {\nnet/ipv6/mcast.c:271:\t\tstruct inet6_dev *idev = in6_dev_get(dev);\nnet/ipv6/mcast.c-272-\n--\nnet/ipv6/mcast.c=313=static struct inet6_dev *ip6_mc_find_idev(struct net *net,\n--\nnet/ipv6/mcast.c-323-\nnet/ipv6/mcast.c:324:\tidev = in6_dev_get(dev);\nnet/ipv6/mcast.c-325-\tdev_put(dev);\n--\nnet/ipv6/mcast.c=933=static int __ipv6_dev_mc_inc(struct net_device *dev,\n--\nnet/ipv6/mcast.c-939-\t/* we need to take a reference on idev */\nnet/ipv6/mcast.c:940:\tidev = in6_dev_get(dev);\nnet/ipv6/mcast.c-941-\tif (!idev)\n--\nnet/ipv6/mcast.c=1023=int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)\n--\nnet/ipv6/mcast.c-1027-\nnet/ipv6/mcast.c:1028:\tidev = in6_dev_get(dev);\nnet/ipv6/mcast.c-1029-\tif (!idev)\n--\nnet/ipv6/mcast.c=1042=bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,\n--\nnet/ipv6/mcast.c-1049-\trcu_read_lock();\nnet/ipv6/mcast.c:1050:\tidev = __in6_dev_get(dev);\nnet/ipv6/mcast.c-1051-\tif (!idev)\n--\nnet/ipv6/mcast.c=1402=void igmp6_event_query(struct sk_buff *skb)\nnet/ipv6/mcast.c-1403-{\nnet/ipv6/mcast.c:1404:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/mcast.c-1405-\tbool put = false;\n--\nnet/ipv6/mcast.c=1426=static void __mld_query_work(struct sk_buff *skb)\n--\nnet/ipv6/mcast.c-1457-\nnet/ipv6/mcast.c:1458:\tidev = in6_dev_get(skb-\u003edev);\nnet/ipv6/mcast.c-1459-\tif (!idev)\n--\nnet/ipv6/mcast.c=1582=void igmp6_event_report(struct sk_buff *skb)\nnet/ipv6/mcast.c-1583-{\nnet/ipv6/mcast.c:1584:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/mcast.c-1585-\tbool put = false;\n--\nnet/ipv6/mcast.c=1606=static void __mld_report_work(struct sk_buff *skb)\n--\nnet/ipv6/mcast.c-1632-\nnet/ipv6/mcast.c:1633:\tidev = in6_dev_get(skb-\u003edev);\nnet/ipv6/mcast.c-1634-\tif (!idev)\n--\nnet/ipv6/mcast.c=1830=static void mld_sendpack(struct sk_buff *skb)\n--\nnet/ipv6/mcast.c-1842-\trcu_read_lock();\nnet/ipv6/mcast.c:1843:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/mcast.c-1844-\tIP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);\n--\nnet/ipv6/mcast.c=2174=static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)\n--\nnet/ipv6/mcast.c-2205-\tnet = dev_net_rcu(dev);\nnet/ipv6/mcast.c:2206:\tidev = __in6_dev_get(dev);\nnet/ipv6/mcast.c-2207-\tIP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);\n--\nnet/ipv6/mcast.c=2845=void ipv6_mc_destroy_dev(struct inet6_dev *idev)\n--\nnet/ipv6/mcast.c-2858-\t/* We cannot call ipv6_dev_mc_dec() directly, our caller in\nnet/ipv6/mcast.c:2859:\t * addrconf.c has NULL'd out dev-\u003eip6_ptr so in6_dev_get() will\nnet/ipv6/mcast.c-2860-\t * fail.\n--\nnet/ipv6/mcast.c=2891=static int ipv6_mc_netdev_event(struct notifier_block *this,\n--\nnet/ipv6/mcast.c-2895-\tstruct net_device *dev = netdev_notifier_info_to_dev(ptr);\nnet/ipv6/mcast.c:2896:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/mcast.c-2897-\n--\nnet/ipv6/mcast.c=2923=static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)\n--\nnet/ipv6/mcast.c-2931-\t\tstruct inet6_dev *idev;\nnet/ipv6/mcast.c:2932:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/mcast.c-2933-\t\tif (!idev)\n--\nnet/ipv6/mcast.c=2945=static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr6 *im)\n--\nnet/ipv6/mcast.c-2955-\t\t}\nnet/ipv6/mcast.c:2956:\t\tstate-\u003eidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/mcast.c-2957-\t\tif (!state-\u003eidev)\n--\nnet/ipv6/mcast.c=3032=static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)\n--\nnet/ipv6/mcast.c-3042-\t\tstruct inet6_dev *idev;\nnet/ipv6/mcast.c:3043:\t\tidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/mcast.c-3044-\t\tif (unlikely(idev == NULL))\n--\nnet/ipv6/mcast.c=3060=static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_sf_list *psf)\n--\nnet/ipv6/mcast.c-3072-\t\t\t}\nnet/ipv6/mcast.c:3073:\t\t\tstate-\u003eidev = __in6_dev_get(state-\u003edev);\nnet/ipv6/mcast.c-3074-\t\t\tif (!state-\u003eidev)\n--\nnet/ipv6/ndisc.c=325=static int ndisc_constructor(struct neighbour *neigh)\n--\nnet/ipv6/ndisc.c-332-\nnet/ipv6/ndisc.c:333:\tin6_dev = in6_dev_get(dev);\nnet/ipv6/ndisc.c-334-\tif (!in6_dev) {\n--\nnet/ipv6/ndisc.c=400=static bool ndisc_allow_add(const struct net_device *dev,\n--\nnet/ipv6/ndisc.c-402-{\nnet/ipv6/ndisc.c:403:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/ndisc.c-404-\n--\nnet/ipv6/ndisc.c=440=static void ip6_nd_hdr(struct sk_buff *skb,\n--\nnet/ipv6/ndisc.c-449-\trcu_read_lock();\nnet/ipv6/ndisc.c:450:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ndisc.c-451-\ttclass = idev ? READ_ONCE(idev-\u003ecnf.ndisc_tclass) : 0;\n--\nnet/ipv6/ndisc.c=468=void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,\n--\nnet/ipv6/ndisc.c-508-\tdev = dst_dev_rcu(dst);\nnet/ipv6/ndisc.c:509:\tidev = __in6_dev_get(dev);\nnet/ipv6/ndisc.c-510-\tIP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);\n--\nnet/ipv6/ndisc.c=581=static void ndisc_send_unsol_na(struct net_device *dev)\n--\nnet/ipv6/ndisc.c-585-\nnet/ipv6/ndisc.c:586:\tidev = in6_dev_get(dev);\nnet/ipv6/ndisc.c-587-\tif (!idev)\n--\nnet/ipv6/ndisc.c=788=static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)\n--\nnet/ipv6/ndisc.c-895-\nnet/ipv6/ndisc.c:896:\t\tidev = in6_dev_get(dev);\nnet/ipv6/ndisc.c-897-\t\tif (!idev) {\n--\nnet/ipv6/ndisc.c=987=static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)\n--\nnet/ipv6/ndisc.c-996-\tstruct net_device *dev = skb-\u003edev;\nnet/ipv6/ndisc.c:997:\tstruct inet6_dev *idev = __in6_dev_get(dev);\nnet/ipv6/ndisc.c-998-\tstruct inet6_ifaddr *ifp;\n--\nnet/ipv6/ndisc.c=1126=static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)\n--\nnet/ipv6/ndisc.c-1139-\nnet/ipv6/ndisc.c:1140:\tidev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ndisc.c-1141-\tif (!idev) {\n--\nnet/ipv6/ndisc.c=1231=static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)\n--\nnet/ipv6/ndisc.c-1267-\nnet/ipv6/ndisc.c:1268:\tin6_dev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ndisc.c-1269-\tif (!in6_dev) {\n--\nnet/ipv6/ndisc.c=1791=static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)\nnet/ipv6/ndisc.c-1792-{\nnet/ipv6/ndisc.c:1793:\tstruct inet6_dev *idev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/ndisc.c-1794-\n--\nnet/ipv6/ndisc.c=1856=static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)\n--\nnet/ipv6/ndisc.c-1869-\tcase NETDEV_UP:\nnet/ipv6/ndisc.c:1870:\t\tidev = in6_dev_get(dev);\nnet/ipv6/ndisc.c-1871-\t\tif (!idev)\n--\nnet/ipv6/ndisc.c-1878-\tcase NETDEV_CHANGE:\nnet/ipv6/ndisc.c:1879:\t\tidev = in6_dev_get(dev);\nnet/ipv6/ndisc.c-1880-\t\tif (!idev)\n--\nnet/ipv6/ndisc.c=1929=int ndisc_ifinfo_sysctl_change(const struct ctl_table *ctl, int write, void *buffer,\n--\nnet/ipv6/ndisc.c-1953-\nnet/ipv6/ndisc.c:1954:\tif (write \u0026\u0026 ret == 0 \u0026\u0026 dev \u0026\u0026 (idev = in6_dev_get(dev)) != NULL) {\nnet/ipv6/ndisc.c-1955-\t\tif (ctl-\u003edata == NEIGH_VAR_PTR(idev-\u003end_parms, BASE_REACHABLE_TIME))\n--\nnet/ipv6/netfilter/nf_tproxy_ipv6.c=10=nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,\n--\nnet/ipv6/netfilter/nf_tproxy_ipv6.c-20-\nnet/ipv6/netfilter/nf_tproxy_ipv6.c:21:\tindev = __in6_dev_get(skb-\u003edev);\nnet/ipv6/netfilter/nf_tproxy_ipv6.c-22-\tif (indev) {\n--\nnet/ipv6/route.c=160=static void rt6_uncached_list_flush_dev(struct net_device *dev)\n--\nnet/ipv6/route.c-177-\t\t\tif (rt_idev \u0026\u0026 rt_idev-\u003edev == dev) {\n\n"
} |
| 7/2 | 2026/08/01 20:28 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23815 output: 22 thoughts: 237 Thoughts: **Analyzing the IPv6 Refcount Bug Fix** Okay, so this `in6_dev_get` function is apparently a real workhorse in the IPv6 networking stack. I knew it was heavily used, but now I need to dive into this refcount bug fix. The tricky part, as usual, is that `in6_dev_get` is inlined – it doesn't have its own symbol. That means I'll have to look upstream to the functions that *call* it. Since my focus is on user-space impact, I need to focus on the call sites that are exposed via the system calls and ioctls and netlink, and so on. Let's make a list. `ipv6_sock_ac_join`, `ipv6_dev_ac_dec`, `inet6_netconf_get_devconf`, `inet6_netconf_dump_devconf`, and all the NDISC-related calls, like `ndisc_constructor`, `ndisc_send_unsol_na`, `ndisc_recv_ns`, `ndisc_netdev_event`, and `ndisc_ifinfo_sysctl_change`. It's a long list, but it's important to find the right candidates. Now, because `in6_dev_get` is called *everywhere* in the IPv6 stack, I don't want to get lost in a forest of code. I'll start with the functions that look like good candidates: `ipv6_sock_ac_join` and `ipv6_sock_ac_drop`. Let's see if these two functions are the source of the refcount bug. |
| 8/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "ipv6_sock_ac_join"
}Results: {
"Output": "include/net/addrconf.h=304=void addrconf_prefix_rcv(struct net_device *dev,\n--\ninclude/net/addrconf.h-309- */\ninclude/net/addrconf.h:310:int ipv6_sock_ac_join(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-311-\t\t const struct in6_addr *addr);\n--\nnet/ipv6/anycast.c=55=static u32 inet6_acaddr_hash(const struct net *net,\n--\nnet/ipv6/anycast.c-66-\nnet/ipv6/anycast.c:67:int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)\nnet/ipv6/anycast.c-68-{\n--\nnet/ipv6/ipv6_sockglue.c=376=int do_ipv6_setsockopt(struct sock *sk, int level, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-892-\t\tif (optname == IPV6_JOIN_ANYCAST)\nnet/ipv6/ipv6_sockglue.c:893:\t\t\tretv = ipv6_sock_ac_join(sk, mreq.ipv6mr_ifindex, \u0026mreq.ipv6mr_acaddr);\nnet/ipv6/ipv6_sockglue.c-894-\t\telse\n"
} |
| 9/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 24808 output: 22 thoughts: 61 Thoughts: Okay, here's my take on those thoughts, framed as my own mental processing: **Examining a Potential Vulnerability** Alright, so `ipv6_sock_ac_join` is called directly from `do_ipv6_setsockopt`, specifically when the `IPV6_JOIN_ANYCAST` option is used. That's immediately interesting – direct userspace access is a classic entry point. This makes it a prime candidate for closer inspection. I need to understand what's happening within this function and how it interacts with the broader kernel environment. Let's see... the code's definitely reachable. Now, let's pivot and look at the corresponding "drop" function, `ipv6_sock_ac_drop`. Understanding the drop path is just as crucial. It's often where the corresponding error handling or cleanup logic lives – and where vulnerabilities tend to hide if not properly handled. Gotta see if the drop path has similar flaws, or if one path is more problematic than the other. |
| 10/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "ipv6_sock_ac_drop"
}Results: {
"Output": "include/net/addrconf.h=310=int ipv6_sock_ac_join(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-311-\t\t const struct in6_addr *addr);\ninclude/net/addrconf.h:312:int ipv6_sock_ac_drop(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-313-\t\t const struct in6_addr *addr);\n--\nnet/ipv6/anycast.c=67=int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)\n--\nnet/ipv6/anycast.c-172- */\nnet/ipv6/anycast.c:173:int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)\nnet/ipv6/anycast.c-174-{\n--\nnet/ipv6/ipv6_sockglue.c=376=int do_ipv6_setsockopt(struct sock *sk, int level, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-894-\t\telse\nnet/ipv6/ipv6_sockglue.c:895:\t\t\tretv = ipv6_sock_ac_drop(sk, mreq.ipv6mr_ifindex, \u0026mreq.ipv6mr_acaddr);\nnet/ipv6/ipv6_sockglue.c-896-\t\tbreak;\n"
} |
| 11/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25491 output: 24 thoughts: 74 Thoughts: Okay, let's break this down. **Targeting IPv6 Socket Options for Analysis** Right, so `ipv6_sock_ac_drop`, that's a key function to look at. We see it's called from `do_ipv6_setsockopt`, specifically for `IPV6_LEAVE_ANYCAST`. Those two functions, `ipv6_sock_ac_drop` and `do_ipv6_setsockopt`, they're definitely prime candidates for deeper inspection. We should be able to dig up something interesting. Let's not stop there, though. We also need to get a handle on the network configuration. I need to check out what's going on with `inet6_netconf_get_devconf` and `inet6_netconf_dump_devconf`. That'll provide a more complete picture of the landscape. It's about pulling together all the pieces. |
| 12/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "inet6_netconf_get_devconf"
}Results: {
"Output": "net/ipv6/addrconf.c=618=static int inet6_netconf_valid_get_req(struct sk_buff *skb,\n--\nnet/ipv6/addrconf.c-656-\nnet/ipv6/addrconf.c:657:static int inet6_netconf_get_devconf(struct sk_buff *in_skb,\nnet/ipv6/addrconf.c-658-\t\t\t\t struct nlmsghdr *nlh,\n--\nnet/ipv6/addrconf.c=7535=static const struct rtnl_msg_handler addrconf_rtnl_msg_handlers[] __initconst_or_module = {\n--\nnet/ipv6/addrconf.c-7551-\t{.owner = THIS_MODULE, .protocol = PF_INET6, .msgtype = RTM_GETNETCONF,\nnet/ipv6/addrconf.c:7552:\t .doit = inet6_netconf_get_devconf, .dumpit = inet6_netconf_dump_devconf,\nnet/ipv6/addrconf.c-7553-\t .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED},\n"
} |
| 13/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26101 output: 23 thoughts: 46 Thoughts: Here's my summary, as though I'm thinking through this process: **Diving into IPv6 Configuration** Okay, so I'm looking at these netlink handlers, `inet6_netconf_get_devconf` and `inet6_netconf_dump_devconf`. They're the go-to functions for retrieving and dumping IPv6 device configuration. My immediate thought is, let's trace this and see what they're doing on the inside. Understanding how that data is exposed is key. Given I'm looking at networking stuff, I need to understand how the system is behaving during neighbor discovery, and to that end, my next logical step is to check how `ndisc_send_unsol_na` is being used. I need to understand how unsolicited neighbor advertisements are being handled and managed within this configuration context. It'll give me a view into how other nodes are updated with the device configuration. |
| 14/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "ndisc_send_unsol_na"
}Results: {
"Output": "net/ipv6/ndisc.c=579=EXPORT_SYMBOL_GPL(ndisc_send_na);\nnet/ipv6/ndisc.c-580-\nnet/ipv6/ndisc.c:581:static void ndisc_send_unsol_na(struct net_device *dev)\nnet/ipv6/ndisc.c-582-{\n--\nnet/ipv6/ndisc.c=1856=static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)\n--\nnet/ipv6/ndisc.c-1874-\t\t READ_ONCE(net-\u003eipv6.devconf_all-\u003endisc_notify))\nnet/ipv6/ndisc.c:1875:\t\t\tndisc_send_unsol_na(dev);\nnet/ipv6/ndisc.c-1876-\t\tin6_dev_put(idev);\n--\nnet/ipv6/ndisc.c-1898-\tcase NETDEV_NOTIFY_PEERS:\nnet/ipv6/ndisc.c:1899:\t\tndisc_send_unsol_na(dev);\nnet/ipv6/ndisc.c-1900-\t\tbreak;\n"
} |
| 15/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26689 output: 21 thoughts: 31 Thoughts: Here's my attempt at summarizing those thoughts, speaking as an expert in the field: **Network Interface Event Handling - A Quick Review** Okay, so I'm thinking about how the system handles network interface events, specifically in the context of IPv6 address configuration. I know that `ndisc_send_unsol_na` gets triggered when certain network device events occur. That's fairly clear. But then the question arises: What about `addrconf_prefix_rcv`? Does that method get called on those same events? Are they called at all, or are they mutually exclusive? Does one trigger the other? I need to clarify the relationship between those two functions. I should make sure I understand the full event handling workflow. |
| 16/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "addrconf_prefix_rcv"
}Results: {
"Output": "include/net/addrconf.h=153=void addrconf_add_linklocal(struct inet6_dev *idev,\n--\ninclude/net/addrconf.h-155-\ninclude/net/addrconf.h:156:int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,\ninclude/net/addrconf.h-157-\t\t\t\t const struct prefix_info *pinfo,\n--\ninclude/net/addrconf.h=282=static inline bool ipv6_is_mld(struct sk_buff *skb, int nexthdr, int offset)\n--\ninclude/net/addrconf.h-303-\ninclude/net/addrconf.h:304:void addrconf_prefix_rcv(struct net_device *dev,\ninclude/net/addrconf.h-305-\t\t\t u8 *opt, int len, bool sllao);\n--\nnet/6lowpan/ndisc.c=188=static void lowpan_ndisc_prefix_rcv_add_addr(struct net *net,\n--\nnet/6lowpan/ndisc.c-203-\t !addrconf_ifid_802154_6lowpan(addr-\u003es6_addr + 8, dev)) {\nnet/6lowpan/ndisc.c:204:\t\terr = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,\nnet/6lowpan/ndisc.c-205-\t\t\t\t\t\t addr, addr_type, addr_flags,\n--\nnet/ipv6/addrconf.c=1369=static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)\n--\nnet/ipv6/addrconf.c-1483-\tcfg.ifa_flags = IFA_F_TEMPORARY;\nnet/ipv6/addrconf.c:1484:\t/* set in addrconf_prefix_rcv() */\nnet/ipv6/addrconf.c-1485-\tif (ifp-\u003eflags \u0026 IFA_F_OPTIMISTIC)\n--\nnet/ipv6/addrconf.c=2689=static bool is_addr_mode_generate_stable(struct inet6_dev *idev)\n--\nnet/ipv6/addrconf.c-2694-\nnet/ipv6/addrconf.c:2695:int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,\nnet/ipv6/addrconf.c-2696-\t\t\t\t const struct prefix_info *pinfo,\n--\nnet/ipv6/addrconf.c-2795-}\nnet/ipv6/addrconf.c:2796:EXPORT_SYMBOL_GPL(addrconf_prefix_rcv_add_addr);\nnet/ipv6/addrconf.c-2797-\nnet/ipv6/addrconf.c:2798:void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)\nnet/ipv6/addrconf.c-2799-{\n--\nnet/ipv6/addrconf.c-2942-ok:\nnet/ipv6/addrconf.c:2943:\t\terr = addrconf_prefix_rcv_add_addr(net, dev, pinfo, in6_dev,\nnet/ipv6/addrconf.c-2944-\t\t\t\t\t\t \u0026addr, addr_type,\n--\nnet/ipv6/ndisc.c=1231=static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)\n--\nnet/ipv6/ndisc.c-1546-\t\t p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {\nnet/ipv6/ndisc.c:1547:\t\t\taddrconf_prefix_rcv(skb-\u003edev, (u8 *)p,\nnet/ipv6/ndisc.c-1548-\t\t\t\t\t (p-\u003end_opt_len) \u003c\u003c 3,\n"
} |
| 17/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27924 output: 18 thoughts: 178 Thoughts: **My Initial Assessment of Promising IPv6 Network Packet Handlers** Okay, so I'm looking at `addrconf_prefix_rcv`. That's ideal. It's called directly from `ndisc_router_discovery`, which is itself triggered by incoming router advertisements. Meaning, it's reacting directly to network packets – that's the kind of entry point I want to examine. Now, let's nail down the specific functions that are worth digging into. I've got a list here: `ipv6_sock_ac_join`, `ipv6_sock_ac_drop`, `inet6_netconf_get_devconf`, `inet6_netconf_dump_devconf`, `ndisc_router_discovery` (which we already know is interesting), `ndisc_recv_ns`, `ndisc_recv_na`, and `ndisc_recv_rs`. Yep, all of these look like excellent targets. They're all handling or reacting to network-level events, giving me a solid basis for further analysis. Before I go further, I should just verify the prerequisites. I'm assuming IPv6 is enabled by `CONFIG_IPV6`, so I'll quickly check that to make sure I am working with a correctly configured environment. |
| 18/2 | 2026/08/01 20:29 | tool | grepper |
0mArgs:{
"Expression": "config IPV6"
}Results: {
"Output": "net/ipv6/Kconfig-5-\nnet/ipv6/Kconfig:6:menuconfig IPV6\nnet/ipv6/Kconfig-7-\tbool \"The IPv6 protocol\"\n--\nnet/ipv6/Kconfig=19=if IPV6\nnet/ipv6/Kconfig-20-\nnet/ipv6/Kconfig:21:config IPV6_ROUTER_PREF\nnet/ipv6/Kconfig-22-\tbool \"IPv6: Router Preference (RFC 4191) support\"\n--\nnet/ipv6/Kconfig-30-\nnet/ipv6/Kconfig:31:config IPV6_ROUTE_INFO\nnet/ipv6/Kconfig-32-\tbool \"IPv6: Route Information (RFC 4191) support\"\n--\nnet/ipv6/Kconfig-38-\nnet/ipv6/Kconfig:39:config IPV6_OPTIMISTIC_DAD\nnet/ipv6/Kconfig-40-\tbool \"IPv6: Enable RFC 4429 Optimistic DAD\"\n--\nnet/ipv6/Kconfig=102=config INET6_IPCOMP\n--\nnet/ipv6/Kconfig-111-\nnet/ipv6/Kconfig:112:config IPV6_MIP6\nnet/ipv6/Kconfig-113-\ttristate \"IPv6: Mobility\"\n--\nnet/ipv6/Kconfig-119-\nnet/ipv6/Kconfig:120:config IPV6_ILA\nnet/ipv6/Kconfig-121-\ttristate \"IPv6: Identifier Locator Addressing (ILA)\"\n--\nnet/ipv6/Kconfig=146=config INET6_TUNNEL\n--\nnet/ipv6/Kconfig-149-\nnet/ipv6/Kconfig:150:config IPV6_VTI\nnet/ipv6/Kconfig-151-\ttristate \"Virtual (secure) IPv6: tunneling\"\n--\nnet/ipv6/Kconfig-161-\nnet/ipv6/Kconfig:162:config IPV6_SIT\nnet/ipv6/Kconfig-163-\ttristate \"IPv6: IPv6-in-IPv4 tunnel (SIT driver)\"\n--\nnet/ipv6/Kconfig-176-\nnet/ipv6/Kconfig:177:config IPV6_SIT_6RD\nnet/ipv6/Kconfig-178-\tbool \"IPv6: IPv6 Rapid Deployment (6RD)\"\n--\nnet/ipv6/Kconfig-195-\nnet/ipv6/Kconfig:196:config IPV6_NDISC_NODETYPE\nnet/ipv6/Kconfig-197-\tbool\nnet/ipv6/Kconfig-198-\nnet/ipv6/Kconfig:199:config IPV6_TUNNEL\nnet/ipv6/Kconfig-200-\ttristate \"IPv6: IP-in-IPv6 tunnel (RFC2473)\"\n--\nnet/ipv6/Kconfig-209-\nnet/ipv6/Kconfig:210:config IPV6_GRE\nnet/ipv6/Kconfig-211-\ttristate \"IPv6: GRE tunnel\"\n--\nnet/ipv6/Kconfig-227-\nnet/ipv6/Kconfig:228:config IPV6_FOU\nnet/ipv6/Kconfig-229-\ttristate\n--\nnet/ipv6/Kconfig-231-\nnet/ipv6/Kconfig:232:config IPV6_FOU_TUNNEL\nnet/ipv6/Kconfig-233-\ttristate\n--\nnet/ipv6/Kconfig-236-\nnet/ipv6/Kconfig:237:config IPV6_MULTIPLE_TABLES\nnet/ipv6/Kconfig-238-\tbool \"IPv6: Multiple Routing Tables\"\n--\nnet/ipv6/Kconfig-242-\nnet/ipv6/Kconfig:243:config IPV6_SUBTREES\nnet/ipv6/Kconfig-244-\tbool \"IPv6: source address based routing\"\n--\nnet/ipv6/Kconfig-256-\nnet/ipv6/Kconfig:257:config IPV6_MROUTE\nnet/ipv6/Kconfig-258-\tbool \"IPv6: multicast routing\"\n--\nnet/ipv6/Kconfig-264-\nnet/ipv6/Kconfig:265:config IPV6_MROUTE_MULTIPLE_TABLES\nnet/ipv6/Kconfig-266-\tbool \"IPv6: multicast policy routing\"\n--\nnet/ipv6/Kconfig-278-\nnet/ipv6/Kconfig:279:config IPV6_PIMSM_V2\nnet/ipv6/Kconfig-280-\tbool \"IPv6: PIM-SM version 2 support\"\n--\nnet/ipv6/Kconfig-285-\nnet/ipv6/Kconfig:286:config IPV6_SEG6_LWTUNNEL\nnet/ipv6/Kconfig-287-\tbool \"IPv6: Segment Routing Header encapsulation support\"\n--\nnet/ipv6/Kconfig-299-\nnet/ipv6/Kconfig:300:config IPV6_SEG6_HMAC\nnet/ipv6/Kconfig-301-\tbool \"IPv6: Segment Routing HMAC support\"\n--\nnet/ipv6/Kconfig-311-\nnet/ipv6/Kconfig:312:config IPV6_SEG6_BPF\nnet/ipv6/Kconfig-313-\tdef_bool y\n--\nnet/ipv6/Kconfig-316-\nnet/ipv6/Kconfig:317:config IPV6_RPL_LWTUNNEL\nnet/ipv6/Kconfig-318-\tbool \"IPv6: RPL Source Routing Header support\"\n--\nnet/ipv6/Kconfig-327-\nnet/ipv6/Kconfig:328:config IPV6_IOAM6_LWTUNNEL\nnet/ipv6/Kconfig-329-\tbool \"IPv6: IOAM Pre-allocated Trace insertion support\"\n"
} |
| 19/2 | 2026/08/01 20:29 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29936 output: 22 thoughts: 3595 Thoughts: **Analysis of `in6_dev_get` Usage within the IPv6 Stack** Okay, so I need to incorporate `IPV6` into the `EnableConfigs`. The core of this is the modification to `in6_dev_get`, which is a fundamental IPv6 function. I need to make sure I understand the scope of this change, particularly where `in6_dev_get` is called. My investigation has confirmed that `in6_dev_get` is called directly in multiple important functions. These include `ipv6_sock_ac_join`, which is responsible for joining anycast sockets, `inet6_netconf_get_devconf` which deals with network configuration and `addrconf_prefix_rcv` that is used to process prefix information. These are all good targets to test. Furthermore, I need to make sure I don't miss any relevant uses of `in6_dev_get`. `ndisc_recv_ns` in the neighbor discovery code also uses it directly. Additionally, I need to be aware of `__in6_dev_get` as there are a number of instances of this in the code. I am thinking of `addrconf_notify` and `addrconf_ifdown` as well. In addition, `ipv6_dev_mc_dec`, `ipv6_dev_mc_inc`, `__ipv6_dev_mc_inc`, `igmp6_event_query`, `igmp6_event_report` and `mld_sendpack` all uses `__in6_dev_get`. So, to be very thorough, I will add `ipv6_sock_ac_join`, `ndisc_recv_ns`, `inet6_netconf_get_devconf`, `addrconf_prefix_rcv`, `ipv6_dev_mc_dec` and `__ipv6_dev_mc_inc` to my `FocusSymbols` list to make sure the implications of this change are fully assessed. |
| 20/2 | 2026/08/01 20:30 | tool | grepper |
0mArgs:{
"Expression": "ipv6_dev_mc_inc"
}Results: {
"Output": "include/net/addrconf.h=259=bool inet6_mc_check(const struct sock *sk, const struct in6_addr *mc_addr,\n--\ninclude/net/addrconf.h-261-\ninclude/net/addrconf.h:262:int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr);\ninclude/net/addrconf.h-263-int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr);\n--\nnet/bridge/br_multicast.c=4233=static void br_ip6_multicast_join_snoopers(struct net_bridge *br)\n--\nnet/bridge/br_multicast.c-4237-\tipv6_addr_set(\u0026addr, htonl(0xff020000), 0, 0, htonl(0x6a));\nnet/bridge/br_multicast.c:4238:\tipv6_dev_mc_inc(br-\u003edev, \u0026addr);\nnet/bridge/br_multicast.c-4239-}\n--\nnet/ipv6/addrconf.c=377=static struct inet6_dev *ipv6_add_dev(struct net_device *dev)\n--\nnet/ipv6/addrconf.c-471-\t\t/* Join interface-local all-node multicast group */\nnet/ipv6/addrconf.c:472:\t\tipv6_dev_mc_inc(dev, \u0026in6addr_interfacelocal_allnodes);\nnet/ipv6/addrconf.c-473-\nnet/ipv6/addrconf.c-474-\t\t/* Join all-node multicast group */\nnet/ipv6/addrconf.c:475:\t\tipv6_dev_mc_inc(dev, \u0026in6addr_linklocal_allnodes);\nnet/ipv6/addrconf.c-476-\n--\nnet/ipv6/addrconf.c-478-\t\tif (ndev-\u003ecnf.forwarding \u0026\u0026 (dev-\u003eflags \u0026 IFF_MULTICAST))\nnet/ipv6/addrconf.c:479:\t\t\tipv6_dev_mc_inc(dev, \u0026in6addr_linklocal_allrouters);\nnet/ipv6/addrconf.c-480-\t}\n--\nnet/ipv6/addrconf.c=806=static void dev_forward_change(struct inet6_dev *idev)\n--\nnet/ipv6/addrconf.c-818-\t\tif (idev-\u003ecnf.forwarding) {\nnet/ipv6/addrconf.c:819:\t\t\tipv6_dev_mc_inc(dev, \u0026in6addr_linklocal_allrouters);\nnet/ipv6/addrconf.c:820:\t\t\tipv6_dev_mc_inc(dev, \u0026in6addr_interfacelocal_allrouters);\nnet/ipv6/addrconf.c:821:\t\t\tipv6_dev_mc_inc(dev, \u0026in6addr_sitelocal_allrouters);\nnet/ipv6/addrconf.c-822-\t\t} else {\n--\nnet/ipv6/addrconf.c=2254=void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)\n--\nnet/ipv6/addrconf.c-2261-\taddrconf_addr_solict_mult(addr, \u0026maddr);\nnet/ipv6/addrconf.c:2262:\tipv6_dev_mc_inc(dev, \u0026maddr);\nnet/ipv6/addrconf.c-2263-}\n--\nnet/ipv6/mcast.c=91=static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,\nnet/ipv6/mcast.c-92-\t\t\t struct inet6_dev *idev);\nnet/ipv6/mcast.c:93:static int __ipv6_dev_mc_inc(struct net_device *dev,\nnet/ipv6/mcast.c-94-\t\t\t const struct in6_addr *addr, unsigned int mode);\n--\nnet/ipv6/mcast.c=198=static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,\n--\nnet/ipv6/mcast.c-233-\t/* now add/increase the group membership on the device */\nnet/ipv6/mcast.c:234:\terr = __ipv6_dev_mc_inc(dev, addr, mode);\nnet/ipv6/mcast.c-235-\n--\nnet/ipv6/mcast.c=894=static void inet6_ifmcaddr_notify(struct net_device *dev,\n--\nnet/ipv6/mcast.c-932- */\nnet/ipv6/mcast.c:933:static int __ipv6_dev_mc_inc(struct net_device *dev,\nnet/ipv6/mcast.c-934-\t\t\t const struct in6_addr *addr, unsigned int mode)\n--\nnet/ipv6/mcast.c-979-\nnet/ipv6/mcast.c:980:int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)\nnet/ipv6/mcast.c-981-{\nnet/ipv6/mcast.c:982:\treturn __ipv6_dev_mc_inc(dev, addr, MCAST_EXCLUDE);\nnet/ipv6/mcast.c-983-}\nnet/ipv6/mcast.c:984:EXPORT_SYMBOL(ipv6_dev_mc_inc);\nnet/ipv6/mcast.c-985-\n--\nnet/ipv6/ndisc.c=373=static int pndisc_constructor(struct pneigh_entry *n)\n--\nnet/ipv6/ndisc.c-382-\taddrconf_addr_solict_mult(addr, \u0026maddr);\nnet/ipv6/ndisc.c:383:\treturn ipv6_dev_mc_inc(dev, \u0026maddr);\nnet/ipv6/ndisc.c-384-}\n"
} |
| 21/2 | 2026/08/01 20:30 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35539 output: 22 thoughts: 64 Thoughts: Okay, let's break this down. **Diving into IPv6 Multicast Join Operations** Right, so I'm looking at the internals of IPv6 multicast joins, specifically, the `__ipv6_sock_mc_join` function. From what I can see, that function calls `__ipv6_dev_mc_inc`, and that, in turn, calls `in6_dev_get`. That whole flow seems like a good place to start digging deeper. `ipv6_sock_mc_join` itself looks like a likely target to explore further. I think I'll focus on `ipv6_sock_mc_join`. Let's check it. |
| 22/2 | 2026/08/01 20:30 | tool | grepper |
0mArgs:{
"Expression": "ipv6_sock_mc_join"
}Results: {
"Output": "drivers/net/vxlan/vxlan_multicast.c=17=int vxlan_igmp_join(struct vxlan_dev *vxlan, union vxlan_addr *rip,\n--\ndrivers/net/vxlan/vxlan_multicast.c-41-\t\tlock_sock(sk);\ndrivers/net/vxlan/vxlan_multicast.c:42:\t\tret = ipv6_sock_mc_join(sk, ifindex, \u0026ip-\u003esin6.sin6_addr);\ndrivers/net/vxlan/vxlan_multicast.c-43-\t\trelease_sock(sk);\n--\ninclude/net/addrconf.h=244=static inline bool ipv6_mc_may_pull(struct sk_buff *skb,\n--\ninclude/net/addrconf.h-252-\ninclude/net/addrconf.h:253:int ipv6_sock_mc_join(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-254-\t\t const struct in6_addr *addr);\n--\ninclude/net/ipv6.h=1227=void ipv6_sysctl_unregister(void);\n--\ninclude/net/ipv6.h-1229-\ninclude/net/ipv6.h:1230:int ipv6_sock_mc_join(struct sock *sk, int ifindex,\ninclude/net/ipv6.h-1231-\t\t const struct in6_addr *addr);\ninclude/net/ipv6.h:1232:int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,\ninclude/net/ipv6.h-1233-\t\t\t const struct in6_addr *addr, unsigned int mode);\n--\nnet/ipv6/addrconf.c=3016=static int ipv6_mc_config(struct sock *sk, bool join,\n--\nnet/ipv6/addrconf.c-3024-\tif (join)\nnet/ipv6/addrconf.c:3025:\t\tret = ipv6_sock_mc_join(sk, ifindex, addr);\nnet/ipv6/addrconf.c-3026-\telse\n--\nnet/ipv6/ipv6_sockglue.c=146=static int do_ipv6_mcast_group_source(struct sock *sk, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-171-\t\tpsin6 = (struct sockaddr_in6 *)\u0026greqs.gsr_group;\nnet/ipv6/ipv6_sockglue.c:172:\t\tretv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface,\nnet/ipv6/ipv6_sockglue.c-173-\t\t\t\t\t \u0026psin6-\u003esin6_addr,\n--\nnet/ipv6/ipv6_sockglue.c=262=static int ipv6_mcast_join_leave(struct sock *sk, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-276-\tif (optname == MCAST_JOIN_GROUP)\nnet/ipv6/ipv6_sockglue.c:277:\t\treturn ipv6_sock_mc_join(sk, greq.gr_interface,\nnet/ipv6/ipv6_sockglue.c-278-\t\t\t\t\t \u0026psin6-\u003esin6_addr);\n--\nnet/ipv6/ipv6_sockglue.c=282=static int compat_ipv6_mcast_join_leave(struct sock *sk, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-296-\tif (optname == MCAST_JOIN_GROUP)\nnet/ipv6/ipv6_sockglue.c:297:\t\treturn ipv6_sock_mc_join(sk, gr32.gr_interface,\nnet/ipv6/ipv6_sockglue.c-298-\t\t\t\t\t\u0026psin6-\u003esin6_addr);\n--\nnet/ipv6/ipv6_sockglue.c=376=int do_ipv6_setsockopt(struct sock *sk, int level, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-874-\t\tif (optname == IPV6_ADD_MEMBERSHIP)\nnet/ipv6/ipv6_sockglue.c:875:\t\t\tretv = ipv6_sock_mc_join(sk, mreq.ipv6mr_ifindex, \u0026mreq.ipv6mr_multiaddr);\nnet/ipv6/ipv6_sockglue.c-876-\t\telse\n--\nnet/ipv6/mcast.c=172=static struct net_device *ip6_mc_find_dev(struct net *net,\n--\nnet/ipv6/mcast.c-197- */\nnet/ipv6/mcast.c:198:static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,\nnet/ipv6/mcast.c-199-\t\t\t const struct in6_addr *addr, unsigned int mode)\n--\nnet/ipv6/mcast.c-248-\nnet/ipv6/mcast.c:249:int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)\nnet/ipv6/mcast.c-250-{\nnet/ipv6/mcast.c:251:\treturn __ipv6_sock_mc_join(sk, ifindex, addr, MCAST_EXCLUDE);\nnet/ipv6/mcast.c-252-}\nnet/ipv6/mcast.c:253:EXPORT_SYMBOL(ipv6_sock_mc_join);\nnet/ipv6/mcast.c-254-\nnet/ipv6/mcast.c:255:int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,\nnet/ipv6/mcast.c-256-\t\t\t const struct in6_addr *addr, unsigned int mode)\nnet/ipv6/mcast.c-257-{\nnet/ipv6/mcast.c:258:\treturn __ipv6_sock_mc_join(sk, ifindex, addr, mode);\nnet/ipv6/mcast.c-259-}\n--\nnet/netfilter/ipvs/ip_vs_sync.c=1403=static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,\n--\nnet/netfilter/ipvs/ip_vs_sync.c-1411-\tlock_sock(sk);\nnet/netfilter/ipvs/ip_vs_sync.c:1412:\tret = ipv6_sock_mc_join(sk, dev-\u003eifindex, addr);\nnet/netfilter/ipvs/ip_vs_sync.c-1413-\trelease_sock(sk);\n--\nnet/tipc/udp_media.c=404=static int enable_mcast(struct udp_bearer *ub, struct udp_media_addr *remote)\n--\nnet/tipc/udp_media.c-416-\t\tlock_sock(sk);\nnet/tipc/udp_media.c:417:\t\terr = ipv6_sock_mc_join(sk, ub-\u003eifindex, \u0026remote-\u003eipv6);\nnet/tipc/udp_media.c-418-\t\trelease_sock(sk);\n"
} |
| 23/2 | 2026/08/01 20:30 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 37620 output: 22 thoughts: 158 Thoughts: **My Focus List for IPv6 Socket Multicast Operations** Okay, after considering the initial options, `ipv6_sock_mc_join` and `ipv6_sock_mc_drop` also seem like excellent targets for closer inspection. I'll add them to the list, clearly. So, to be precise, my current focus is on these functions: * `ipv6_sock_ac_join` * `ipv6_sock_ac_drop` * `ipv6_sock_mc_join` * `ipv6_sock_mc_drop` * `inet6_netconf_get_devconf` * `addrconf_prefix_rcv` * `ndisc_recv_ns` Hang on a moment... is the function name for dropping multicast correctly stated as `ipv6_sock_mc_drop`? Better double check that to confirm. Gotta make sure the details are precise. |
| 24/2 | 2026/08/01 20:30 | tool | grepper |
0mArgs:{
"Expression": "ipv6_sock_mc_drop"
}Results: {
"Output": "drivers/net/vxlan/vxlan_multicast.c=50=int vxlan_igmp_leave(struct vxlan_dev *vxlan, union vxlan_addr *rip,\n--\ndrivers/net/vxlan/vxlan_multicast.c-74-\t\tlock_sock(sk);\ndrivers/net/vxlan/vxlan_multicast.c:75:\t\tret = ipv6_sock_mc_drop(sk, ifindex, \u0026ip-\u003esin6.sin6_addr);\ndrivers/net/vxlan/vxlan_multicast.c-76-\t\trelease_sock(sk);\n--\ninclude/net/addrconf.h=253=int ipv6_sock_mc_join(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-254-\t\t const struct in6_addr *addr);\ninclude/net/addrconf.h:255:int ipv6_sock_mc_drop(struct sock *sk, int ifindex,\ninclude/net/addrconf.h-256-\t\t const struct in6_addr *addr);\n--\ninclude/net/ipv6.h=1232=int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,\ninclude/net/ipv6.h-1233-\t\t\t const struct in6_addr *addr, unsigned int mode);\ninclude/net/ipv6.h:1234:int ipv6_sock_mc_drop(struct sock *sk, int ifindex,\ninclude/net/ipv6.h-1235-\t\t const struct in6_addr *addr);\n--\nnet/ipv6/addrconf.c=3016=static int ipv6_mc_config(struct sock *sk, bool join,\n--\nnet/ipv6/addrconf.c-3026-\telse\nnet/ipv6/addrconf.c:3027:\t\tret = ipv6_sock_mc_drop(sk, ifindex, addr);\nnet/ipv6/addrconf.c-3028-\trelease_sock(sk);\n--\nnet/ipv6/ipv6_sockglue.c=262=static int ipv6_mcast_join_leave(struct sock *sk, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-278-\t\t\t\t\t \u0026psin6-\u003esin6_addr);\nnet/ipv6/ipv6_sockglue.c:279:\treturn ipv6_sock_mc_drop(sk, greq.gr_interface, \u0026psin6-\u003esin6_addr);\nnet/ipv6/ipv6_sockglue.c-280-}\n--\nnet/ipv6/ipv6_sockglue.c=282=static int compat_ipv6_mcast_join_leave(struct sock *sk, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-298-\t\t\t\t\t\u0026psin6-\u003esin6_addr);\nnet/ipv6/ipv6_sockglue.c:299:\treturn ipv6_sock_mc_drop(sk, gr32.gr_interface, \u0026psin6-\u003esin6_addr);\nnet/ipv6/ipv6_sockglue.c-300-}\n--\nnet/ipv6/ipv6_sockglue.c=376=int do_ipv6_setsockopt(struct sock *sk, int level, int optname,\n--\nnet/ipv6/ipv6_sockglue.c-876-\t\telse\nnet/ipv6/ipv6_sockglue.c:877:\t\t\tretv = ipv6_sock_mc_drop(sk, mreq.ipv6mr_ifindex, \u0026mreq.ipv6mr_multiaddr);\nnet/ipv6/ipv6_sockglue.c-878-\t\tbreak;\n--\nnet/ipv6/mcast.c=255=int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,\n--\nnet/ipv6/mcast.c-263- */\nnet/ipv6/mcast.c:264:static void __ipv6_sock_mc_drop(struct sock *sk, struct ipv6_mc_socklist *mc_lst)\nnet/ipv6/mcast.c-265-{\n--\nnet/ipv6/mcast.c-288-\nnet/ipv6/mcast.c:289:int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)\nnet/ipv6/mcast.c-290-{\n--\nnet/ipv6/mcast.c-303-\t\t\t*lnk = mc_lst-\u003enext;\nnet/ipv6/mcast.c:304:\t\t\t__ipv6_sock_mc_drop(sk, mc_lst);\nnet/ipv6/mcast.c-305-\t\t\treturn 0;\n--\nnet/ipv6/mcast.c-310-}\nnet/ipv6/mcast.c:311:EXPORT_SYMBOL(ipv6_sock_mc_drop);\nnet/ipv6/mcast.c-312-\n--\nnet/ipv6/mcast.c=330=void __ipv6_sock_mc_close(struct sock *sk)\n--\nnet/ipv6/mcast.c-336-\t\tnp-\u003eipv6_mc_list = mc_lst-\u003enext;\nnet/ipv6/mcast.c:337:\t\t__ipv6_sock_mc_drop(sk, mc_lst);\nnet/ipv6/mcast.c-338-\t}\n--\nnet/ipv6/mcast.c=353=int ip6_mc_source(int add, int omode, struct sock *sk,\n--\nnet/ipv6/mcast.c-482-\tif (leavegroup)\nnet/ipv6/mcast.c:483:\t\terr = ipv6_sock_mc_drop(sk, pgsr-\u003egsr_interface, group);\nnet/ipv6/mcast.c-484-\treturn err;\n--\nnet/ipv6/mcast.c=487=int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,\n--\nnet/ipv6/mcast.c-580-\tif (leavegroup)\nnet/ipv6/mcast.c:581:\t\terr = ipv6_sock_mc_drop(sk, gsf-\u003egf_interface, group);\nnet/ipv6/mcast.c-582-\treturn err;\n"
} |
| 25/2 | 2026/08/01 20:30 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 39626 output: 205 thoughts: 188 Thoughts: **Analyzing Potential Vulnerabilities** Okay, yes, `ipv6_sock_mc_drop` feels like a solid starting point for investigation. Let me run through this list of functions again. We have: `ipv6_sock_ac_join`, `ipv6_sock_ac_drop`, `ipv6_sock_mc_join`, `ipv6_sock_mc_drop`, `inet6_netconf_get_devconf`, `addrconf_prefix_rcv`, and `ndisc_recv_ns`. Right. The common thread here is that all these functions are directly accessible from userspace or triggered by network packets, and crucially, they all call `in6_dev_get` or its variant `__in6_dev_get`. And that, as I recall, is exactly the function that the patch targets, specifically to fix that pesky refcount bug. The patch is addressing `in6_dev_get` after all. And the necessary configuration flag is, as expected, `IPV6`. Given all this, I'm confident in my analysis and will commit my findings. |
| 26/2 | 2026/08/01 20:30 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"IPV6"
],
"FocusSymbols": [
"ipv6_sock_ac_join",
"ipv6_sock_ac_drop",
"ipv6_sock_mc_join",
"ipv6_sock_mc_drop",
"inet6_netconf_get_devconf",
"addrconf_prefix_rcv",
"ndisc_recv_ns"
],
"Reasoning": "The patch fixes a potential use-after-free or refcount underflow in the core IPv6 function `in6_dev_get` by using `refcount_inc_not_zero`. Since `in6_dev_get` is an inline function, we focus fuzzing on several key IPv6 functions that call it and are directly reachable from userspace (via setsockopt or netlink) or network packets (via neighbor discovery and router advertisements).",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"IPV6"
],
"FocusSymbols": [
"ipv6_sock_ac_join",
"ipv6_sock_ac_drop",
"ipv6_sock_mc_join",
"ipv6_sock_mc_drop",
"inet6_netconf_get_devconf",
"addrconf_prefix_rcv",
"ndisc_recv_ns"
],
"Reasoning": "The patch fixes a potential use-after-free or refcount underflow in the core IPv6 function `in6_dev_get` by using `refcount_inc_not_zero`. Since `in6_dev_get` is an inline function, we focus fuzzing on several key IPv6 functions that call it and are directly reachable from userspace (via setsockopt or netlink) or network packets (via neighbor discovery and router advertisements).",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|