* Patch "ipv6: fix calling in6_ifa_hold incorrectly for dad work" has been added to the 4.11-stable tree
@ 2017-06-29 16:58 gregkh
0 siblings, 0 replies; only message in thread
From: gregkh @ 2017-06-29 16:58 UTC (permalink / raw)
To: lucien.xin, davem, gregkh, hannes, weichen; +Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
ipv6: fix calling in6_ifa_hold incorrectly for dad work
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From foo@baz Thu Jun 29 18:58:00 CEST 2017
From: Xin Long <lucien.xin@gmail.com>
Date: Thu, 15 Jun 2017 16:33:58 +0800
Subject: ipv6: fix calling in6_ifa_hold incorrectly for dad work
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ]
Now when starting the dad work in addrconf_mod_dad_work, if the dad work
is idle and queued, it needs to hold ifa.
The problem is there's one gap in [1], during which if the pending dad work
is removed elsewhere. It will miss to hold ifa, but the dad word is still
idea and queue.
if (!delayed_work_pending(&ifp->dad_work))
in6_ifa_hold(ifp);
<--------------[1]
mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
An use-after-free issue can be caused by this.
Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in
net6_ifa_finish_destroy was hit because of it.
As Hannes' suggestion, this patch is to fix it by holding ifa first in
addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if
the dad_work is already in queue.
Note that this patch did not choose to fix it with:
if (!mod_delayed_work(delay))
in6_ifa_hold(ifp);
As with it, when delay == 0, dad_work would be scheduled immediately, all
addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.
Reported-by: Wei Chen <weichen@redhat.com>
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -328,9 +328,9 @@ static void addrconf_mod_rs_timer(struct
static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
unsigned long delay)
{
- if (!delayed_work_pending(&ifp->dad_work))
- in6_ifa_hold(ifp);
- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+ in6_ifa_hold(ifp);
+ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
+ in6_ifa_put(ifp);
}
static int snmp6_alloc_dev(struct inet6_dev *idev)
Patches currently in stable-queue which might be from lucien.xin@gmail.com are
queue-4.11/ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch
queue-4.11/igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch
queue-4.11/sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch
queue-4.11/sctp-disable-bh-in-sctp_for_each_endpoint.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2017-06-29 16:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-29 16:58 Patch "ipv6: fix calling in6_ifa_hold incorrectly for dad work" has been added to the 4.11-stable tree gregkh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.