[PATCH net-next] ipv6/addrconf: ensure addrconf_verify_rtnl() has completed

[PATCH net-next] ipv6/addrconf: ensure addrconf_verify_rtnl() has completed

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

Before freeing the hash table in addrconf_exit_net(),
we need to make sure the work queue has completed,
or risk NULL dereference or UAF.

Thus, use cancel_delayed_work_sync() to enforce this.
We do not hold RTNL in addrconf_exit_net(), making this safe.

Fixes: 8805d13ff1b2 ("ipv6/addrconf: use one delayed work per netns")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 57fbd6f03ff8d118e50d8aa6ea0ab938a1bb3cbc..44e164706340959b85f8f2d5d562caf8e37aea67 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -7187,7 +7187,7 @@ static void __net_exit addrconf_exit_net(struct net *net)
 	kfree(net->ipv6.devconf_all);
 	net->ipv6.devconf_all = NULL;
 
-	cancel_delayed_work(&net->ipv6.addr_chk_work);
+	cancel_delayed_work_sync(&net->ipv6.addr_chk_work);
 	/*
 	 *	Check hash table, then free it.
 	 */
-- 
2.35.1.265.g69c8d7142f-goog

Re: [PATCH net-next] ipv6/addrconf: ensure addrconf_verify_rtnl() has completed

[David Ahern]

On 2/16/22 11:20 AM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> Before freeing the hash table in addrconf_exit_net(),
> we need to make sure the work queue has completed,
> or risk NULL dereference or UAF.
> 
> Thus, use cancel_delayed_work_sync() to enforce this.
> We do not hold RTNL in addrconf_exit_net(), making this safe.
> 
> Fixes: 8805d13ff1b2 ("ipv6/addrconf: use one delayed work per netns")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> ---
>  net/ipv6/addrconf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net-next] ipv6/addrconf: ensure addrconf_verify_rtnl() has completed

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 16 Feb 2022 10:20:37 -0800 you wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> Before freeing the hash table in addrconf_exit_net(),
> we need to make sure the work queue has completed,
> or risk NULL dereference or UAF.
> 
> Thus, use cancel_delayed_work_sync() to enforce this.
> We do not hold RTNL in addrconf_exit_net(), making this safe.
> 
> [...]

Here is the summary with links:
  - [net-next] ipv6/addrconf: ensure addrconf_verify_rtnl() has completed
    https://git.kernel.org/netdev/net-next/c/be6b41c15dc0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html