| From foo@baz Thu Jun 29 19:45:34 CEST 2017 |
| From: Xin Long <lucien.xin@gmail.com> |
| Date: Thu, 15 Jun 2017 16:33:58 +0800 |
| Subject: ipv6: fix calling in6_ifa_hold incorrectly for dad work |
| |
| From: Xin Long <lucien.xin@gmail.com> |
| |
| |
| [ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ] |
| |
| Now when starting the dad work in addrconf_mod_dad_work, if the dad work |
| is idle and queued, it needs to hold ifa. |
| |
| The problem is there's one gap in [1], during which if the pending dad work |
| is removed elsewhere. It will miss to hold ifa, but the dad word is still |
| idea and queue. |
| |
| if (!delayed_work_pending(&ifp->dad_work)) |
| in6_ifa_hold(ifp); |
| <--------------[1] |
| mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); |
| |
| An use-after-free issue can be caused by this. |
| |
| Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in |
| net6_ifa_finish_destroy was hit because of it. |
| |
| As Hannes' suggestion, this patch is to fix it by holding ifa first in |
| addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if |
| the dad_work is already in queue. |
| |
| Note that this patch did not choose to fix it with: |
| |
| if (!mod_delayed_work(delay)) |
| in6_ifa_hold(ifp); |
| |
| As with it, when delay == 0, dad_work would be scheduled immediately, all |
| addrconf_mod_dad_work(0) callings had to be moved under ifp->lock. |
| |
| Reported-by: Wei Chen <weichen@redhat.com> |
| Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Signed-off-by: Xin Long <lucien.xin@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv6/addrconf.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| --- a/net/ipv6/addrconf.c |
| +++ b/net/ipv6/addrconf.c |
| @@ -269,9 +269,9 @@ static void addrconf_mod_rs_timer(struct |
| static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp, |
| unsigned long delay) |
| { |
| - if (!delayed_work_pending(&ifp->dad_work)) |
| - in6_ifa_hold(ifp); |
| - mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); |
| + in6_ifa_hold(ifp); |
| + if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay)) |
| + in6_ifa_put(ifp); |
| } |
| |
| static int snmp6_alloc_dev(struct inet6_dev *idev) |