| From cf5001ad021421160d0db73e2f2e6911539c053e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 31 Aug 2023 22:41:27 -0600 |
| Subject: net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr |
| |
| From: Alex Henrie <alexhenrie24@gmail.com> |
| |
| [ Upstream commit f31867d0d9d82af757c1e0178b659438f4c1ea3c ] |
| |
| The existing code incorrectly casted a negative value (the result of a |
| subtraction) to an unsigned value without checking. For example, if |
| /proc/sys/net/ipv6/conf/*/temp_prefered_lft was set to 1, the preferred |
| lifetime would jump to 4 billion seconds. On my machine and network the |
| shortest lifetime that avoided underflow was 3 seconds. |
| |
| Fixes: 76506a986dc3 ("IPv6: fix DESYNC_FACTOR") |
| Signed-off-by: Alex Henrie <alexhenrie24@gmail.com> |
| Reviewed-by: David Ahern <dsahern@kernel.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ipv6/addrconf.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
| index 94cec2075eee8..c93a2b9a91723 100644 |
| --- a/net/ipv6/addrconf.c |
| +++ b/net/ipv6/addrconf.c |
| @@ -1368,7 +1368,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block) |
| * idev->desync_factor if it's larger |
| */ |
| cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft); |
| - max_desync_factor = min_t(__u32, |
| + max_desync_factor = min_t(long, |
| idev->cnf.max_desync_factor, |
| cnf_temp_preferred_lft - regen_advance); |
| |
| -- |
| 2.40.1 |
| |
