From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D768CC433EF for ; Mon, 14 Mar 2022 11:58:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240066AbiCNMAB (ORCPT ); Mon, 14 Mar 2022 08:00:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240038AbiCNL55 (ORCPT ); Mon, 14 Mar 2022 07:57:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 58937FD28; Mon, 14 Mar 2022 04:56:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EC60861240; Mon, 14 Mar 2022 11:56:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA817C340E9; Mon, 14 Mar 2022 11:56:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647259007; bh=ST0JNt4SsCbzhlPzhi5BjKDyoAMsqZ4S4Oxtdvq81zk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AhqBxFq1jBLbO6Woz85gQS9gd7011wqx+geFen6JnOxmZ2beG5BJkoncetSSd2q0v gqd18YqB1Iu0eS3u5ByKEBgUyRYNyIUB8K5ttz+UHHwauDj2CjzJGcZbaRrmOvURbX HlfnfOUQRxkhuTu18AZcXuHlqhg9qLAtdudmfe+A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , David Ahern , Niels Dossche , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.4 25/43] ipv6: prevent a possible race condition with lifetimes Date: Mon, 14 Mar 2022 12:53:36 +0100 Message-Id: <20220314112735.125130610@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220314112734.415677317@linuxfoundation.org> References: <20220314112734.415677317@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Niels Dossche [ Upstream commit 6c0d8833a605e195ae219b5042577ce52bf71fff ] valid_lft, prefered_lft and tstamp are always accessed under the lock "lock" in other places. Reading these without taking the lock may result in inconsistencies regarding the calculation of the valid and preferred variables since decisions are taken on these fields for those variables. Signed-off-by: Niels Dossche Reviewed-by: David Ahern Signed-off-by: Niels Dossche Link: https://lore.kernel.org/r/20220223131954.6570-1-niels.dossche@ugent.be Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv6/addrconf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index d1f29a3eb70b..60d070b25484 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -4924,6 +4924,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) goto error; + spin_lock_bh(&ifa->lock); if (!((ifa->flags&IFA_F_PERMANENT) && (ifa->prefered_lft == INFINITY_LIFE_TIME))) { preferred = ifa->prefered_lft; @@ -4945,6 +4946,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa, preferred = INFINITY_LIFE_TIME; valid = INFINITY_LIFE_TIME; } + spin_unlock_bh(&ifa->lock); if (!ipv6_addr_any(&ifa->peer_addr)) { if (nla_put_in6_addr(skb, IFA_LOCAL, &ifa->addr) < 0 || -- 2.34.1