inet6_create() reads net->ipv6.sysctl.bindv6only locklessly.

Use READ_ONCE() for this sysctl access.
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
v2:
- Shorten the commit message per review feedback
- Drop the Fixes and stable CC trailers

 net/ipv6/af_inet6.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0a88b376141d..79fc6ce6ff77 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -211,7 +211,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
 	np->pmtudisc	= IPV6_PMTUDISC_WANT;
 	inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
 				      FLOWLABEL_REFLECT_ESTABLISHED);
-	sk->sk_ipv6only	= net->ipv6.sysctl.bindv6only;
+	sk->sk_ipv6only	= READ_ONCE(net->ipv6.sysctl.bindv6only);
 	sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
 
 	/* Init the ipv4 part of the socket since we can have sockets
-- 
2.34.1

On Tue, Jun 02, 2026 at 08:24:14AM +0800, Runyu Xiao wrote:
> inet6_create() reads net->ipv6.sysctl.bindv6only locklessly.
> 
> Use READ_ONCE() for this sysctl access.

There should be a blank line here.

> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

For net-next:

Reviewed-by: Ido Schimmel <idosch@nvidia.com>